Audit Trails and Relay Blocking Lists

Check out this article on It's an editorial by David Lazarus that talks about a local arts group being listed on Joe Jared's block list, for running an open relay. Here's a couple of snippets from it:
A little digging revealed that OsiruSoft, based in the Southern California city of Orange, is a one-man operation run by a software programmer named Joe Jared. He began keeping a list of spammers and potential spammers a couple of years ago purely as a way to protect his own computers.
I asked if he had evidence that Theatre Arts' server in fact had been used for spam.
"No," Jared admitted. "But if it had not been, my system would not have found it."

"I have no record of any spam," Jared replied. "But I know how my system operates.
The author of the editorial goes to great pains to paint Joe in a bad light.

I think Joe has the right to put whatever he wants into his list, so I disagree with the overall tone of the editorial. But, I'm also concerned for Joe. I think that practical necessity states that a blocking list operator needs to keep an audit trail, in case a listee ever brings legal action.

Legal issues aside, it would also have helped to keep the listed arts group, and the newspaper editorialist, from finding easy ammo to use against Joe. I think the listed group would have understood what was going on a lot easier if there was archived proof that spam was actually relayed through the server.

Do you think the editorial would have been different (or would it even have been written), if when David Lazarus had talked to Joe, if the conversation included "Here's when it was listed. Here's when we received spam through it. Here's a copy of that spam." I think things would have went differently, and Joe would've come off a lot more favorably.

Why does that matter? Because getting other internet users to support a blocking list, to use it, means explaining things so they can understand what it does and why it exists. If they incorrectly think that a list operator simply scans the internet looking for things to block, or if they correctly realize that a list doesn't make proof available to substantiate a claim, they're less likely to believe in you or your goals.

Nick Renton

On July 31, 2001, Nick Renton, of Melbourne, Australia, wrote an interesting commentary on why a new anti-spam blacklist, called ORBL, was a bad thing.

Oddly enough, the only reason I knew about this, is because Mr. Renton actually chose to advertise this fact to me -- by emailing me a copy of the article.

Never having heard of him, and having never received email from him previously, I asked him why he had sent this to me.

His reply was that as we were both an email discussion list, he thought that I would be interested in hearing from him.

I tried to explain to him that just because I posted to a mailing list doesn't mean that I'm open to duplicating discussions offlist, and that it was inconsiderate of him to take such a liberty.

His indignant reply made it very clear that he thought he had the right to email anybody he pleased. In fact, he explicitly stated this: "I will decide to whom I write. You can decide what you read."

Well, gee, I thought, isn't that nice. That kind of attitude is exactly what made me decide to block mail from spammers in the first place. No, they don't have a right to email anybody they want. It is not a right, as ISPs regularly demonstrate when they revoke the access of spammers.

So I wrote a letter to that same newspaper explaining my side and my opinion. To my surprise and delight, they published it on September 25, 2001.

Interestingly, he later responded, both in print, and on the mailing list, with a rebuttal to my rebuttal. I couldn't find a link to an online version, so I've archived a local copy here.

In it, he claims that advertising his article to me was acceptable because it was not bulk, and I was somebody who was confirmed to be interested in the subject.

Unfortunately, that's not correct. Not only are these determinations that do not apply to the permission to send email, but these are determinations that an end recipient of an email cannot see. This would seem less disingenuous if he had actually mentioned this in any of his contact with me.

No matter -- it wouldn't have made it acceptable even if he had. If I start emailing people at random copies of my article, even if I narrow that list down to people whom I know to be involved in the anti-spam community, I need to have their permission to contact them. To do otherwise would invite accusations of spamming.

Next, he commented that phone solicitations are an issue of greater irritation, the implication being that my efforts are poorly focused on something he deems unworthy. Though I appreciate the good laugh this gives me, I'm confused as to why this would be seen as a reason to stay away from a cause or take action against something you find harmful or disrespectful.

First, there is always going to be something that is more important than what you're doing. With war, famine, and disease in the world, there will always be some situation that is worse than yours, or is of greater import to the world community. If you allow that to stop you, you will never do anything, because there will always be something bigger, and worse. The answer is: you do what you can on things that you are able to affect. Life exists on many levels.

To rebut my statement that email blocking is legal, Mr. Renton says the laws need to be changed. He cites as a possible parallel that it's illegal to interfere with postal mail. His cite is accurate, but misapplied. An email server is not a public, government-sanctioned, government-controlled enterprise. It's a private delivery service. Just like FedEx or UPS. Private delivery services are perfectly free to restrict what they'll deliver for you. The law is quite clear in that regard. And in my opinion, correct.


As you probably know, I used to be associated with the Mail Abuse Prevention System, the well-known anti-spam blacklist group.

Though I continue to fully support a network owner's right to block email from whomever they please, I no longer have faith in MAPS' goals or mission.

I don't think MAPS will survive much longer, at the very least, due to monetary issues. MAPS had a long standing goal of inviting lawsuits with the intent of setting legal precedents that support the stance that email blocking is an acceptable practice.

Ramblings about MAPS and the RBL

I used to work for the Mail Abuse Prevention System (MAPS). They maintain, among other things, the Realtime Blackhole List (RBL).

The MAPS RBL is a list of Internet sites. On this list are sites that have sent spam, assisted people who sent spam, benefited from spam, or due to other, generally related criteria.