Home page logo
/

nanog logo nanog mailing list archives

RE: ORBS (Re: Scanning)
From: Derek Balling <dredd () megacity org>
Date: Sun, 27 May 2001 11:40:37 -0700


 > I think this is all a phrasology thing.

I'm sorry. I hate hare-splitting too.

So long as we at least decide what it is we're disagreeing on. ;-)

My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a
MAPS-known spam source.


That's what I had thought you meant. :)

 >     Then your statement further makes no sense, because any
 non-MAPS-listed host could (in theory) send mail to/through that
 system. If the system using MAPS is an open relay, then
 non-MAPS-listed hosts could quite happily/easily pump mail through
 that system regardless of whether or not it is using MAPS.

Not true, I'm assuming that MAPS isn't the only anti-spam measures being
implemented.

But @BLOCKED_HOSTS != @WHOLE_OF_INTERNET, so it doesn't matter WHAT anti-spam features they're using, if they're an open relay, they deserve to be in ORBS.

Another hair to split is that "ORBS" is not a list. It's a COLLECTION of lists. The above-described open-relay should be listed on the inputs.orbs.org list.

 > I think my personal evidence (that about 90-95% of my spam that is
 blocked is NOT from MAPS sources) does not seem to bear that out.

You bear out my assumptions that other methods, besides MAPS and ORBS, are
being deployed as well. Feeding such data into MAPS would improve MAPS
accuracy.

I don't think so. Judging from discussions in forums where this topic is more prevalent (spam-l, spamtools) MAPS seems to be a bit of a blackhole itself, with lots of sites being nominated as spam sources for the MAPS RBL and very few actually seeming to get listed.

D

--
+---------------------+-----------------------------------------+
| dredd () megacity org  | "Conan! What is best in life?"          |
|  Derek J. Balling   | "To crush your enemies, see them        |
|                     |    driven before you, and to hear the   |
|                     |    lamentation of their women!"         |
+---------------------+-----------------------------------------+


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault