October 11, 2004

Power of Blogging: Word of Mouth FINALLY gets my SORBS issue fixed

Well, there is proof yet again of the power of blogging. If you recall at the beginning of the month I complained that SORBS was erroneously blocking my company's IP address block, and constant attempts to communicate with SORBS from both myself and my ISP went unanswered. I was blacklisted from most of my colleagues, which makes it EXTREMELY difficult to communicate with anyone, including people I am working with at a few security and antivirus companies, and of course Microsoft. I was starting to lose business opportunities due to lack of communication, and I was thinking about moving to a different ISP before I lost any real business.

Well apparently my blog entry made its way around the "inner-circle" of those that matter at SORBS, getting posted to an internal mailing list of SORBS gods and someone had the bright idea that it might make sense to go and fix it. I appreciate that. So it looks like life is back to normal on the mail server front. I SHOULD be able to communicate again with everyone. If you emailed me and you think I didn't respond, you might want to resend your email.

Good lesson to be learned here though. It is amazing how a volunteer organization ran by one man can negatively affect business around the globe. I wonder who watches the watchers? If Matt and the crew at SORBS doesn't like someone, and decides to take their time in removing an IP address that 'accidentally' got blacklisted... there is NOTHING you can do about it. No relief. No recourse. No one to turn to. And this is for our CRITICAL communication infrastructure.

Now to be fair, for all I know this could have been an honest mistake and a rare occurance. The fact that it took OVER A MONTH though should show that it doesn't matter. In the face of failure there should be quick, clear and concise remedies for recovery. Someone made a mistake with my IP block. Fine. But waiting a month before fixing it was unacceptable. Imagine if I was Ebay, Amazon or some other heavy hitting online business. I'd probably go sue your ass for the lost profits. And then a great service would be in litigation and end up folding. That doesn't help anyone.

Posted by SilverStr at October 11, 2004 08:30 AM | TrackBack
Comments

I know EXACTLY where you're coming from. Our company is an insurance brokerage who basically shops around for the best insurance deals for individuals or entire companies. One of the companies we deal with Blue Cross Blue Shield, I believe, uses a blacklist program that is very obscure.

Somehow this blacklist added our ISP IP Address block to their list. I made requests to take us off, but nothing was done about it I believe. They tend to only accept information from ISPs only, so if your ISP doesn't "see" it as a problem then they tend to not do anything about it. I don't know if it's an issue any more and hopefully it isn't. The blacklist is a cool idea but it just doesn't really make sense because there is no "police for the police" as you said. I'd rather take the time to blacklist known spam sites or use a baysian filter on the server level than to rely on some 3rd party to tell me what they believe is right and wrong.

The sad part is, we use our own hosting company so it shouldn't matter what IP sends the message. They were blocking OUR IP which shows up in the email header, not the IP address of the server in question. I know it's due to Outlook being run behind a NAT box, but I can't fix this problem without giving everyone a public IP address. I'm not spending money to fix a problem I didn't create.

I sure hope things like this go away though. One company or group of individuals can't police the entire internet. There's just too many implications. I know something should be done now about spam but going about it the wrong way isn't going to help anyone.

Posted by: Jeremy Brayton at October 11, 2004 09:42 AM

Lucky you. It was resolved for you.

But not for me. I've recieved an email like this one:

-------
xxx.xxx.xxx.0/19 might be cheap, but definitely not a good choice for
hosting:

[a few URLs to add value to words]

As for the listing:
http://www.dnsbl.nl.sorbs.net/faq/spamdb.shtml

* You are an innocent party that has been included in a wider listing policy because your provider is happy to host spammer(s) that have spammed a SORBS spamtrap or admin.¹

¹ If you are part of a wider netblock that is blocked you are not required to pay the SORBS 'fine' as the entry was not generated because of your actions, however your netblock will not be removed until your upstream removes the spammers.
-------

I've to use additional ISP for outgoing email and this ISP for incomming-only.

I manage my entire server. It's on dedicated IP. I take full responsibility for software installed on it - but SORBS does not allow me to unblock select IPs from /19 (8192 IPs wide) block.

Blocking innocent parties is totaly wrong. Next time cops instead of searching for person who steal somebody watch - will arrest entire house - you will understand difference.

:-((


P.S> Their request tracking system sucked:

Here is a email I've recieved in return for my request:

"From: RT_CorrespondAddressNotSet@goliath.sorbs.net
Subject: Could not load a valid user
X-RT-Loop-Prevention: sorbs.net
Date: Sat, 17 Jul 2004 19:24:25 +1000 (EST)

RT could not load a valid user, and RT's configuration does not allow for the creation of a new user for your email."

Posted by: AT at October 12, 2004 02:27 AM

> "From: RT_CorrespondAddressNotSet@goliath.sorbs.net
> Subject: Could not load a valid user
> X-RT-Loop-Prevention: sorbs.net
> Date: Sat, 17 Jul 2004 19:24:25 +1000 (EST)

This means you either replied with a different email address than the ticket was created with or the ticket has been moved to a queue where you cannot update messages to (like the DUHL removals queue)

Yours

Mat @ SORBS

Posted by: Matthew Sullivan at November 2, 2004 09:51 PM

Matt,

Thanks for clearing that up for AT. I appreciate you being open and letting us know.

Oh, and welcome to my blog. Where were you a month ago??? :)

Posted by: SilverStr at November 5, 2004 09:21 AM