SORBS Blocklist Reportedly Sold For $451K 88
palegray.net writes "SORBS, a well-known email blocklist provider, has reportedly been sold for $451k. Early reports indicate an acquisition by GFI, a company specializing in various communications services. In recent years, SORBS has been the target of frequent accusations of mismanagement and poor conduct, leading many to wonder if this turn in events might signal a chance for improved behavior. Citing lack of ISP support, the blocklist released statements earlier this year that they would be shuttering their operation."
Why put up with that? (Score:2)
Honestly, that wouldn't make me wonder if SORBS will improve its behavior after an acquisition. No. That would have made me find another blocklist provider a long time ago. Shady/questionable behavior like that goes on only because it's so thoroughly tolerated and often actively supported.
Re: (Score:2)
It might block much of your spam, but blocks a lot of legitimate mail too.
Given the availability of better alternatives, SORBS has been 'not an option' for me since like what. 2003 or so?
Re: (Score:2)
It's largely because most people who administrate mail servers are completely and utter idiots. I've had conversations with mail admins who clearly don't even understand how SMTP works.
Blacklists are bad... bad bad bad bad bad bad bad bad bad. Yes, there are better behaved blacklists than SORBS, but they're all bad because filtering relies ultimately on the sensibility of these administrating the filter.
I'm running no filters and just greylisting and I get spam maybe once every few days. The only legit m
Too bad (Score:3, Interesting)
It is unfortunate that SORBS has gotten a bad rap. Although it has been plagued on the administrative side of things, its list was still helpful in detecting and removing spam.
GFI is a good company - but I am betting the list will no longer be free to use. Everything they sell is licenced on a "per mailbox" structure, and as such I imagine the list will be implemented into their anti-spam products. There may also be a nominal fee (per box) to use the list with other spam filters.
Re: (Score:1)
GFI sends shivers down my back. I always loathed having to pull up that clunky, outdated, poorly layed out interface to manage our Spam filter. I could have lived with the poor interface if their software actually was proactive in Spam filtering, but it was mediocre at best. It wasn't unusual to come in to the office, only to find that my inbox was full of people complaining about the flood of Spam that made it through our filter the previous night. To make matters worse, their tech support was attrocio
Re: (Score:3)
Agreed. We moved away from their spam filtering products a couple years ago and picked up a barracuda appliance. The GFI app was such a worthless hunk of crap, we've never looked back.
Re: (Score:1)
Barracuda was a step _up_?!?! Wow, GFI must be really something :p
Re: (Score:2)
Yup. Why, have you found something that works better than a barracuda appliance?
Right now I might get 1 or 2 spam emails a week with the 'cuda. I haven't had a false positive in 2 years. When we had GFI + RBL's, I'd get about 20+ per day. So... roughly 140 per week down to 1 (sometimes 2). This is not a big company, roughly 3,000 emails per day across all users.
Re: (Score:2, Interesting)
Re: (Score:1)
I'm not sure the problem is that the administrators enjoy their BOFH roles so much as that anyone who runs an anti-spam service is probably someone who's already really, really frustrated with the spam problem, and with dealing with lazy, greedy and incompetent ISPs.
Another thing to consider is that the anti-spam services work for the clients who want the spam stopped, and they don't work for the ISPs that are generating the spam. So they tend to get testy when those ISPs ask for help dealing with their ow
Re: (Score:1)
Having worked for a former ISP of Jermey Janes, lemme just say, it's impossible to educate sales people. They care about their commission, and nothing else. When I checked, they had, in fact, had several connections with us for several years -- all under different names, to different addresses. But T1's were just too small for any real volume. When they ordered a DS3 and colo space, they screwed up and sent out 100,000 "template" spam messages and abuse@ received "many" complaints -- and the f'ing moron
Re: (Score:1)
Lemme guess, there answer was "spamtrap"? For which they will give zero evidence and demand payment to get removed. (That's extortion, btw. But since "we never touch the money" it's not illegal.) All it takes is ONE MESSAGE, EVER, to land in the spamtrap list; listings never expire, and you have to make a "donation" to get delisted. Most interesting is the number of charities refusing to be associated with the SORBS extortion racket.
While I doubt there was much intentional (mis)listings, there certainly
Re:Too bad (Score:4, Informative)
Re:Too bad (Score:4, Informative)
Or how about listing entire netblocks because the RDNS of an IP "looks" dynamic?
I'm serious, they've blocked huge swathes of Linode (a virtual server provider) because Linode's default RDNS format (li12-345.members.linode.com) looks dynamic as if such a thing exists.
Linode's attempts to get the netblocks delisted was met with silence; SORBS simply ignores anybody who tries to get delisted.
Re: (Score:2)
.......unless it's accompanied by cash, naturally.
Check out the Wikipedia entry for SORBS. Someone pointed out that they blocked entire ISPs for almost nothing, and the SORBS revisionists went and started slapping wikipedia vandalism warnings around.
Fuck SORBS, and screw Wikipedia. :|
SORBS became useless years ago. Filtering evolved significantly, they remained back in the useless stone ages. Good riddance.
Re: (Score:2)
I can say right now that this is untrue. I inherited a blacklisted IP address for one of my servers just last week and figured out the hard way that the IP was blacklisted by
Re: (Score:2)
While you may have had a good experience, Linode was met with silence when they requested that their netblocks be removed.
They weren't even listed for spam, they were listed because they were supposedly dynamic! That's right, a SERVER HOST specializing in providing servers with STATIC IP addresses.
Re: (Score:1)
I used to work as an email admin for a large ISP (over 5 million users) and SORBS was very receptive about removing false positive IPs from their list...if we paid them. We finally had to tell customers and outside users that complained to stop using SORBS and use other well run RBLs like Spamhaus.
Re:Too bad (Score:4, Insightful)
It is unfortunate that SORBS has gotten a bad rap. Although it has been plagued on the administrative side of things, its list was still helpful in detecting and removing spam.
So is unplugging your mailserver. It'd get roughly the same number of false positives, except without the malice.
Re: (Score:2)
Took the words out of my mouth.
RBL are a pretty good tools, but they are only as good as the admin team and processes behind it.
"Esoteric" RBL like SORBS are the source of headaches of responsible mail and network admins.
But even SORBS is not much of a problem (not many mail admins use it to block email since they don't want all the false positives). Recently, senderbase has stepped up their efforst to be even more obscure in their reputation systems. And since they are a now Cisco product, you can bet a
Re: (Score:2)
I have about 25 RBLs setup in my spam filtering, each given a different weight, allong with spamassasin, it takes 2-3 results to have a spam blocked (I actually just filter into a Junk folder for the most part, unless it's really bad (takes 5-7 fails) I spent a solid month simply tagging various emails, and checking to see how reliable each list was in my use case to give them their weights. Works pretty well overall, adding in greylisting, and SPF checking helps too. I've been getting about 2 false nega
Re: (Score:2)
25? That seems like a lot. I hope your setup uses short circuiting?
I did a lot of research to find good lists. That means vanishingly small false positive ratios, clear and reasonable methodology that agrees with my philosophies, good organizations behind them, and good coverage in union. I use Spamhaus XBL and SpamCop SCBL. Independently they're great. Adding them together nets an additional 4.4% with just the one additional DNS lookup, totalling, I think it was, 86% (hm, must have had other measures
Re: (Score:1)
It's been poorly run for a long, long time. As an administrator who occasionally had a customer who was blocked by their fault system, I can tell you they have less then a good attitude. Joey, if you ready this, you can suck my nuts. At least Matti will help you if you need it.
Re: (Score:2)
It is unfortunate that SORBS has gotten a bad rap. Although it has been plagued on the administrative side of things, its list was still helpful in detecting and removing spam.
Spoken like someone who's never had to deal with them in any capacity. SORBS was an arrogant list that was out of touch with reality and the problems administrators face. SORBS made far too many arbitrary decisions (like blocking netblocks because they LOOKED dynamic - without bothering to check) and caused real harm and damage to millions of people. They were an embarrassment compared to real lists like Zen/SpamHaus, SpamCop, etc who remained professional and logical and actually had policies and procedure
Re:Too bad - not! (Score:2)
It's unfortunate that SORBS deserved the bad rap they got, but they were quite effective at false-positive mis-detection of legitimate emails as spam, unlike lists such as Spamhaus, and quite unwilling to remove addresses that had been tagged as spam or as part of variously large blocks of ISPs that had had some spammers use them.
There are legitimate uses for a rabid-overkill list, such as directing mail from those IP addresses to a check-more-carefully server if you've got a multi-tier multi-server spam-bl
Re: (Score:2)
It was helpful in detecting email and, based on the lunatic who was running it's particular whims, probably included a healthy dose of legitimate servers that, through no fault of their own, were somehow associated in some convoluted way with IP blocks where spam probably originated at some point anywhere in the last decade or so.
If I
has it (Score:2)
blocklists should be one-way hashes. the user's email address should never even be sent over the wire.
Re: (Score:3, Informative)
Well sorbs (like most DNSBL's) is based on IP address, so generally speaking the users's email address isn't passed over the wire (in terms of BL usage).
Re: (Score:2)
The latter is best implemented as a one-way hash (usually md5) so that the resulting list can't be used for other mailings.
Re: (Score:2)
you bleeping amateurs. (Score:2, Funny)
Right before signing, you should have said, you know what, let's make it $419k. You guys just never miss an opportunity do you.
451K - the temperature that _____ burns? (Score:2)
Spam? Flamers? Email?
Is this good or bad? (Score:1)
That is one hell of a donation. :) I sure hope they fix the removal process. I have been struggling for weeks now to get some netblocks removed.
Re: (Score:3, Interesting)
Re: (Score:2)
This is one of the reasons I use Postini. Dealing with crap like this is now Someone Else's Problem, and that someone happens to be a large, resourceful corporation.
Re: (Score:1)
... who have random mailservers listed in SORBS' spamtrap list. The day my mailserver dropped a message from gmail is the day I stopped using SORBS. This was cast in cement by their bitchy response to my inquiry... "[gmail] doesn't do outbound content filtering, so f*** 'em."
Re: (Score:1)
Re: (Score:1)
If you were worth your salt as an IT guy you would've had your ISP change your IP address though.
Um, no. Just change your IP, lol like nothing else is tied to it. We had a lot of other things that were pointed at that IP, again I did not set it up that way, but nonetheless would have been a cluster had we just up and changed it. In the perfect world you are correct, but we don't live there. And even two weeks in business is way too long to have to wait. Fix the problem let the software test and then de-list. My God I could understand if this was 1969 and some retard was taking requests by phone a
Shuttering their operation? (Score:2)
I can't tell if this is a typo or an actual term someone might use. I suppose shuttering the operation would simply mean concealing it from the public?
Re: (Score:2)
Re: (Score:2)
evidently found someone to give her lots of money for it instead
That's the part that has a bunch of people seriously ticked off. It appears she's landed a "Director of Engineering" title in the process, which I pretty much interpret as being handsomely rewarded for abject failure to run a responsible operation.
Re: (Score:1)
450k isn't that much money as these things go. Still, that's a lot of folding money in one's pocket.
Re: (Score:1)
Shuttering -
1. closing the shutters on the windows of a building (old term, most don't have shutters in 2009)
2. nailing wooden panels over the windows and doors of a condemned building to keep people out
3. nailing wooden panels over the windows and doors of a foreclosed building to preserve resale value of the structure (i.e. prevent vandalism)
The term, in the context used, is perfectly applicable.
Re: (Score:2)
The blacklist itself? The many thousands of IP addresses they have identified as (a lot incorrectly btw) as deliverers of spam?
Re: (Score:1)
The servers, software, database, "reputation", etc. Basically, an anti-spam operation on wheels. ('tho I don't recommend rolling fully loaded racks around. A fully loaded 43U rack can weigh nearly a ton.)
Shutting down (Score:2)
Re: (Score:3, Informative)
not the opposite that happened with others blacklists in the past.
In the one instance that comes to my mind, they answered NOT blacklisted for more than a year after disabling the service. Still the queries came flooding in. In the end the choice was between abandoning the domain (and pushing all that load to the .com or whichever name servers) or answering blacklisted to make people wake up.
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Traditional route (Score:3, Funny)
So, will they go the traditional route and block /0 when they shut down?
Oh my...they overpaid by about $450,999.99 (Score:2)
I don't know of ANY serious ISP that pays any attention to SORBS and it's been that way for a few years. Whoever cashed that $451k check had better squirrel that money away quickly before the unwitting buyer tries to claw it back.
I did not like my interaction with SORBS (Score:4, Insightful)
I was one of the people that had a very bad experience with SORBS.
My company got a new ISP with an external block. I'm sure at some point that block had been used as a dynamic range. I had not set a PTR record (because the IP of the mail server changed at the last second), my PTR and A record for that mail server were not set to 12 hours (seriously, who does that?), and I was banned on the SORBS list. I had an SPF record, you could obviously see that I'm part of a legitimate organization, and it would have taken maybe 2 minutes of work for an physical admin to realize that this was a mistake.
It took two support tickets with SORBS, 5 calls to my ISP, and around 10 days to get off the list. In the meantime, we could not contact certain people using it. And what's worse is that the only solution that the admin of SORBS had was to get everyone to stop using the SORBS list. I think that the TTL requirements are the worst part of their solution.
In my opinion, an unattended, automated black list is worse than the problem of too much spam. You are blocking valid mails, and because you are blocking it at the IP level, the end user doesn't even see it show up in their spam bucket many times. If SORBS had a single admin, checking their email once a day, they could easily filter out some of these issues.
I encouraged several anti-spam vendors to stop using their services for this reason, through the different companies that we interact with. There are several other blacklists that do their job well, there is no need to use an unattended blacklist.
Re: (Score:2)
I run into the same problems constantly. There are far too many small providers around the world who don't know better and subscribe to these awful blocklists. I have a reseller account through Hostnine which I portion out webspace from when non-technical friends need it. The IP address for the space they get is often in SORBS, so a lot of their mail doesn't go through. I find myself moving accounts from the selected location to another part of the world about half the time :(
What we REALLY need is a list o
Re: (Score:1)
Re:I did not like my interaction with SORBS (Score:4, Informative)
Meanwhile, several hundred brain-dead mail administrators, responsible for the delivery of email of tens of thousands of people, are happily using SORBS to block mail based on false assertions that your IP space is dynamically allocated. There's the one-two punch that pretty much guarantees you'll have mail delivery problems. If you're a business, that's a big deal; you could easily find yourself (as many have) unable to send email to partners, suppliers, and customers due to negligence beyond your control.
This isn't about being listed for a few days. It's about doing absolutely nothing wrong in the first place, having SORBS make provably false statements about the usage of entire netblocks, and then sitting by helplessly while SORBS refuses to address the situation, causing real damages to your business for months. I've got news for you: the Internet is bigger than "your ISP", and it's generally considered a bad practice to rely on another organization's SMTP service for your email unless they're an operation specifically geared toward doing so as their primary business model.
Next time you decide to post on a topic, please be certain you're well educated on the subject matter first.
Re: (Score:3, Insightful)
I think the other poster explained my position perfectly well, he gets the issue. The fact that I could get delisted within 10 days is pretty impressive for being listed there, it's normally months. And that's only because my ISP had problems with them before because the guy blocked /20's from them on a regular and repeated basis, it looks like mostly virus related.
And both ISPs were running at the same time, but you can only send mail out one direction. Am I supposed to short circuit our entire operati
Re: (Score:1)
I think the other poster explained my position perfectly well, he gets the issue. The fact that I could get delisted within 10 days is pretty impressive for being listed there, it's normally months.
Strange. We've got an entire /16 listed there a few weeks ago, and it took less than three hours for the block to be gone after us explaining the situation (basically, some hosts were leased using stolen identities to send spam from and were shut down less than 24 hours after they started doing so).
Re: (Score:1)
A GREAT MANY people can tell the same story. SORBS was half-automated. Getting on any of their lists was simple -- a SINGLE email is all it takes. Getting off the list is not automated in ANY way. It takes a human being -- and by all accounts, there was only ever one human -- to remove you. The removal process was never speedy and usually involved a ransom in the form of a donation to an ever dwindling number of charities. (no respectable charity would have anything to do with this crap.)
The internet i
Deep Six? (Score:1)
I *Stopped* using SORBS and SPAM *decreased*. (Score:1)
Re: (Score:1)
Re: (Score:2)
are you suggesting it would not have gone down if you had continued using sorbs? i don't get it. how can you get less spam by blocking less IPs, regardless of whether those IPs are spammers or not?
Re: (Score:2)
Who uses SORBS anyways? (Score:2)
Not me. There are far better ones out there.
Interesting blog from the former owner ... (Score:1)
http://www.myspace.com/michelle_i_sullivan [myspace.com]
"I'm 40 year old transsexual girl ..."
I'm not making this up!