ORBS (Re: Scanning)

Derek Balling dredd at megacity.org
Sun May 27 18:40:37 UTC 2001

>  > I think this is all a phrasology thing.
>I'm sorry. I hate hare-splitting too.

So long as we at least decide what it is we're disagreeing on. ;-)

>My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a
>MAPS-known spam source.

That's what I had thought you meant. :)

>  >     Then your statement further makes no sense, because any
>>  non-MAPS-listed host could (in theory) send mail to/through that
>>  system. If the system using MAPS is an open relay, then
>>  non-MAPS-listed hosts could quite happily/easily pump mail through
>>  that system regardless of whether or not it is using MAPS.
>Not true, I'm assuming that MAPS isn't the only anti-spam measures being

But @BLOCKED_HOSTS != @WHOLE_OF_INTERNET, so it doesn't matter WHAT 
anti-spam features they're using, if they're an open relay, they 
deserve to be in ORBS.

Another hair to split is that "ORBS" is not a list. It's a COLLECTION 
of lists. The above-described open-relay should be listed on the 
inputs.orbs.org list.

>  > I think my personal evidence (that about 90-95% of my spam that is
>>  blocked is NOT from MAPS sources) does not seem to bear that out.
>You bear out my assumptions that other methods, besides MAPS and ORBS, are
>being deployed as well. Feeding such data into MAPS would improve MAPS

I don't think so. Judging from discussions in forums where this topic 
is more prevalent (spam-l, spamtools) MAPS seems to be a bit of a 
blackhole itself, with lots of sites being nominated as spam sources 
for the MAPS RBL and very few actually seeming to get listed.


| dredd at megacity.org  | "Conan! What is best in life?"          |
|  Derek J. Balling   | "To crush your enemies, see them        |
|                     |    driven before you, and to hear the   |
|                     |    lamentation of their women!"         |

More information about the NANOG mailing list