Mailing List Archive: SpamAssassin: users

UCEPROTECT questions

Index | Next | Previous | View Threaded

mysqlstudent at gmail

Nov 25, 2009, 10:45 AM

Post #1 of 17 (1277 views)
Permalink

UCEPROTECT questions

Hi,

I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
wondered if I was doing something wrong.

I've set the score to 0.01 for now, while I watch and see how it works
here. What's a more reasonable score? I don't think I would ever use
UCEPROTECT2 or UCEPROTECT3, as we have a lot of verizon/comcast users
where the whole block or ASN could be blacklisted.

Can you give me some history of this blocklist?

Thanks,
Alex

lists07 at abbacomm

Nov 25, 2009, 10:53 AM

Post #2 of 17 (1247 views)
Permalink

RE: UCEPROTECT questions [In reply to]

>
> I'm interested in people's opinion of UCEPROTECT. I'm aware
> of how it works, but even UCEPROTECT1 seems to catch an awful
> lot of ham, and I wondered if I was doing something wrong.
>
> I've set the score to 0.01 for now, while I watch and see how
> it works here. What's a more reasonable score? I don't think
> I would ever use
> UCEPROTECT2 or UCEPROTECT3, as we have a lot of
> verizon/comcast users where the whole block or ASN could be
> blacklisted.
>
> Can you give me some history of this blocklist?
>
> Thanks,
> Alex
>

Alex,

we use all 3 and adjust score accordingly...

have had good general results since we started using them...

we are not or have not been doing anything scientific with that info, so it
is just another potential spammy sign...

- rh

dan.mcdonald at austinenergy

Nov 25, 2009, 11:03 AM

Post #3 of 17 (1246 views)
Permalink

RE: UCEPROTECT questions [In reply to]

On Wed, 2009-11-25 at 10:53 -0800, R-Elists wrote:
>
> >
> > I'm interested in people's opinion of UCEPROTECT. I'm aware
> > of how it works, but even UCEPROTECT1 seems to catch an awful
> > lot of ham, and I wondered if I was doing something wrong.
> >

>
> Alex,
>
> we use all 3 and adjust score accordingly...

Ditto.

of more interest to me was the ips.backscatterer list. I configured it
like so:

meta RCVD_IN_BACKSCATTER_RELAY (__BOUNCE_FROM_DAEMON && __RCVD_IN_BACKSCATTER) && ! __RCVD_IN_UCEWHITE
tflags RCVD_IN_BACKSCATTER_RELAY net
describe RCVD_IN_BACKSCATTER_RELAY received from a host that does a lot of backscatter
score RCVD_IN_BACKSCATTER_RELAY 1.30

It's helped with some of the backscatter problems we were seeing. I
also haven't been overly scientific about it, but I've not had any
false-positive reports, and I recall at least one false-negative
complaint where RCVD_IN_BACKSCATTER_RELAY had been triggered. (the total
score was only about 4.6, IIRC).

--
Daniel J McDonald, CCIE # 2495, CISSP # 78281, CNX
www.austinenergy.com

richard at buzzhost

Nov 25, 2009, 11:39 AM

Post #4 of 17 (1247 views)
Permalink

Re: UCEPROTECT questions [In reply to]

On Wed, 2009-11-25 at 13:45 -0500, Alex wrote:
> Hi,
>
> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
> wondered if I was doing something wrong.
>
> I've set the score to 0.01 for now, while I watch and see how it works
> here. What's a more reasonable score? I don't think I would ever use
> UCEPROTECT2 or UCEPROTECT3, as we have a lot of verizon/comcast users
> where the whole block or ASN could be blacklisted.
>
> Can you give me some history of this blocklist?
>
> Thanks,
> Alex
I would not trust it to block on as it does appear to catch lots of ham.
Claus, the ?owner? of Uceprotect is a bit of an assclown with an odd
listing policy. This includes buying old expired domains and then
listing anything that emails them. This includes opt-in mail from the
previous domain owner.

There has been quite a bit of discussion on this in the NANAE Usenet
group. You can find references to it via google groups, but be warned
it's a very nasty, aggressive and abusive group to visit.

Mariusz.Kruk at epsilon

Nov 25, 2009, 11:49 AM

Post #5 of 17 (1247 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Alex pisze:
> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
> wondered if I was doing something wrong.

Yes, UCEPROTECT seems to be just a big scam. Only thing it seems to care
about is the money for 'express delisting' or for whitelisting hosts (I
suppose that's why they list whole big networks).
Just one opinion - http://www.aaroncake.net/misc/showthought.asp?thought=57
There are many more like this one on the web.
Too bad there are some commercial appliances that use this RBL by
default. Otherwise noone in their sane minds would use this (at least
not any levels higher than 1).

--
Mariusz Kruk

list-subs at secnap

Nov 25, 2009, 12:58 PM

Post #6 of 17 (1236 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Alex wrote:
> Hi,
>
> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
> wondered if I was doing something wrong.
>
> I've set the score to 0.01 for now, while I watch and see how it works
> here. What's a more reasonable score? I don't think I would ever use
> UCEPROTECT2 or UCEPROTECT3, as we have a lot of verizon/comcast users
> where the whole block or ASN could be blacklisted.
>
> Can you give me some history of this blocklist?
>
> Thanks,
> Alex
>
this is actually an interesting addition to your MTA

from their web site:
Edit /etc/postfix/main.cf:
smtpd_recipient_restrictions =
...
check_sender_access dbm:/etc/postfix/check_backscatterer
...
Create new file:/etc/postfix/check_backscatterer:
<> reject_rbl_client ips.backscatterer.org
postmaster reject_rbl_client ips.backscatterer.org

I decided to try it here with
check_sender_access pcre:check_backscatter.

new file has this in it:

/^(<>$|postmaster@|MAILER-DAEMON)/ reject_rbl_client ips.backscatterer.org

beauty of that is, that it only triggers if the SMTP envelope is <> or
postmaster@* or MAILER-DAEMON*
then it checks the senders ip against the backscatter list.

MOSTLY, what do I care if I don't get ANY bounce, let alone if they are
on the backscatter list.

so, the FPs' would be confined to bounces anyway.

and, at smtp time, the error goes direct to responsible smtp server, and
doesn't create your own backscatter.

_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com
_________________________________________________________________________

per at computer

Nov 26, 2009, 2:20 PM

Post #7 of 17 (1222 views)
Permalink

Re: UCEPROTECT questions [In reply to]

per at computer

Nov 26, 2009, 4:20 PM

Post #8 of 17 (1216 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Mariusz Kruk wrote:

> Alex pisze:
>> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
>> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
>> wondered if I was doing something wrong.
>
> Yes, UCEPROTECT seems to be just a big scam.

A scam?? You'll have to explain that one in a bit more detail. They
provide the data free of charge.

> Just one opinion -
> http://www.aaroncake.net/misc/showthought.asp?thought=57 There are
> many more like this one on the web. Too bad there are some commercial
> appliances that use this RBL by default. Otherwise noone in their sane
> minds would use this (at least not any levels higher than 1).

As usual, it's not UCEPROTECT you should be swearing at, it's the people
who use it.

/Per Jessen, Zürich

kruk at epsilon

Nov 26, 2009, 11:51 PM

Post #9 of 17 (1213 views)
Permalink

Re: UCEPROTECT questions [In reply to]

On Thu, 2009-11-26 at 23:20 +0100, Per Jessen wrote:
> >> I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
> >> works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
> >> wondered if I was doing something wrong.
> >
> > Yes, UCEPROTECT seems to be just a big scam.
>
> A scam?? You'll have to explain that one in a bit more detail. They
> provide the data free of charge.

Scam - something set up only to make money in not-very-fair way.

> > Just one opinion -
> > http://www.aaroncake.net/misc/showthought.asp?thought=57 There are
> > many more like this one on the web. Too bad there are some commercial
> > appliances that use this RBL by default. Otherwise noone in their sane
> > minds would use this (at least not any levels higher than 1).
> As usual, it's not UCEPROTECT you should be swearing at, it's the people
> who use it.

Yes, Them too. But the whole schema of UCEPROTECT operation stinks. They
add people to their blacklists with no clear rules standing behind it.
And they demand money for delisting you. It's a simple extortion.
It's as if I wrote on my webpage 'Per Jessen is a stupid asshole' and
wanted money from you for removal of that text.
The problem is that they are quite popular because they seem so
'professional' so many people get 'hit' by them.

--
d'`'`'`'`'`'`'`'`'`'`'`'`'Yb
`b Kruk [at] epsilon d'
d' http://epsilon.eu.org/ Yb
`b,-,.,-,.,-,.,-,.,-,.,-,.d'

per at computer

Nov 27, 2009, 12:20 AM

Post #10 of 17 (1223 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Mariusz Kruk wrote:

> On Thu, 2009-11-26 at 23:20 +0100, Per Jessen wrote:
>> >> I'm interested in people's opinion of UCEPROTECT. I'm aware of how
>> >> it works, but even UCEPROTECT1 seems to catch an awful lot of ham,
>> >> and I wondered if I was doing something wrong.
>> >
>> > Yes, UCEPROTECT seems to be just a big scam.
>>
>> A scam?? You'll have to explain that one in a bit more detail. They
>> provide the data free of charge.
>
> Scam - something set up only to make money in not-very-fair way.
>

That would seem to describe quite a few businesses I can think of :-)

[snip]
>> As usual, it's not UCEPROTECT you should be swearing at, it's the
>> people who use it.
>
> Yes, Them too. But the whole schema of UCEPROTECT operation stinks.
> They add people to their blacklists with no clear rules standing
> behind it.

This is all you get:
http://www.uceprotect.net/en/index.php?m=3&s=0

If I were to publish some of our internal data, you wouldn't get any
clear information about how we collect it either. Such lists are a
matter of trust and many people obviously trust UCEPROTECT.

/Per Jessen, Zürich

kruk at epsilon

Nov 27, 2009, 12:52 AM

Post #11 of 17 (1207 views)
Permalink

Re: UCEPROTECT questions [In reply to]

On Fri, 2009-11-27 at 09:12 +0100, Per Jessen wrote:
> >> >> I'm interested in people's opinion of UCEPROTECT. I'm aware of how
> >> >> it works, but even UCEPROTECT1 seems to catch an awful lot of ham,
> >> >> and I wondered if I was doing something wrong.
> >> > Yes, UCEPROTECT seems to be just a big scam.
> >> A scam?? You'll have to explain that one in a bit more detail. They
> >> provide the data free of charge.
> > Scam - something set up only to make money in not-very-fair way.
> That would seem to describe quite a few businesses I can think of :-)

I agree ;-)
Sorry, english is not my native language so I can't be more precise
without causing further confusion about the definition itself.

> [snip]
> >> As usual, it's not UCEPROTECT you should be swearing at, it's the
> >> people who use it.
> > Yes, Them too. But the whole schema of UCEPROTECT operation stinks.
> > They add people to their blacklists with no clear rules standing
> > behind it.
> This is all you get:
> http://www.uceprotect.net/en/index.php?m=3&s=0
>
> If I were to publish some of our internal data, you wouldn't get any
> clear information about how we collect it either. Such lists are a
> matter of trust and many people obviously trust UCEPROTECT.

In other words - you don't need to know, you don't want to know, you
won't know. But it's not only that. It's the whole package.
Every respectable RBL has _clear_ rules of
1. Listing
2. Escalation
3. Delisting.
In case of UCEPROTECT it's
1. We list whomever we want
2. We escalate whenever we want. And we don't give a damn whether we
block only a so-called spammer or a whole range of innocent people's
networks. Or even whole ASN-s.
3. Give us your money!
The whole webpage says 'we are very good in blocking spam' but they
don't write about possible false positives, about which every
responsible RBL should inform.
The problem is not in the fact of running RBL as such. The problem is in
misleading people to use this service and using it to gain advantage
over people forcing them to pay money.
Let me compare it to a website. If I run a small private website on
which I write, let's say 'Tom Cruise is a neonazist', noone will
probably notice. But if I run a tabloid and I write something like that,
I'll get my ass sued-off.
UCEPROTECT's case is similar - they try hard to be perceived as a
respectable company so that people use their blacklists. And therefore
raising the pressure on listed people to pay for delisting.

Oh, and BTW, http://www.uceprotect.net/en/index.php?m=2&s=0
See the 15th question's response. I don't know about you but for me
'anonymous circle of well-known people' seems kinda oxymoronic.

And another BTW. I found a mailinglist discussion about UCEPROTECT in
which you also took part (no, I wasn't looking for you :->)
http://lists.swinog.ch/public/swinog/2008-January/002432.html
Don't you think that manually adding someone to a blacklist (for free!
*evil grin*) is tampering with it without clear rules? The guy with the
autoresponder was surely causing some inconvenience but the proper
response was to notify the list owner, not to add IP to the blacklist.

--
[------------------------]
[ Kruk [at] epsilon ]
[ http://epsilon.eu.org/ ]
[------------------------]

kruk at epsilon

Nov 27, 2009, 2:04 AM

Post #12 of 17 (1208 views)
Permalink

Re: UCEPROTECT questions [In reply to]

On Fri, 2009-11-27 at 10:31 +0100, Per Jessen wrote:
> > Every respectable RBL has _clear_ rules of
> > 1. Listing
> Hmm, I'm not so sure - how about spamcop, surbl, uribl, spamhaus? Their
> rules are exactly as clear or unclear as those of uceprotect.

First of all, you have (for example on spamcop):
"The SCBL is an aggressive spam-fighting tool. By using this list, you
can block a lot of spam, but you also may block or filter wanted email.
Because of this limitation, one should strongly consider using the SCBL
as part of a scoring system and explicitly whitelist wanted email
senders (e.g., mailing lists and other IPs from which you want to
receive email)."
and
"New users of the SCBL should read the description below and all other
documentation carefully before deciding to use the SCBL"
But yes, some other RBL's have also unclear rules - I admit.
Yet, the delisting is kinda different isn't it?
Not to mention listing only single IP's, not whole ASN's!
Yes, I use RBL's that list whole networks but only those being DUL's.
And I know what I'm doing and why I'm doing this.

> > The problem is not in the fact of running RBL as such. The problem is
> > in misleading people to use this service and using it to gain
> > advantage over people forcing them to pay money.
> How do you see UCEPROTECT misleading anyone? I think they're actually
> being more open/explicit about their policies than some providers I can
> think of.

Come on. Read the main page on their website. "We are the good knights
in shining armors and they all are a bunch of liers".
Or. "For best results against spammers you will need to use all our
Levels together"
Yes, I know that braindead admins who don't know what they're doing
should get half the credit but that's how life is. And UCEPROTECT just
abuses it. IMHO

> > Oh, and BTW, http://www.uceprotect.net/en/index.php?m=2&s=0
> > See the 15th question's response. I don't know about you but for me
> > 'anonymous circle of well-known people' seems kinda oxymoronic.
> Not at all. I have a circle of friends that are well-known to me - when
> I don't tell everyone who they are, they are anonymous.

'well-known people' and 'people well-known by me' are two different
statements.

> > And another BTW. I found a mailinglist discussion about UCEPROTECT in
> > which you also took part (no, I wasn't looking for you :->)
> > http://lists.swinog.ch/public/swinog/2008-January/002432.html
> > Don't you think that manually adding someone to a blacklist (for free!
> > *evil grin*) is tampering with it without clear rules? The guy with
> > the autoresponder was surely causing some inconvenience but the proper
> > response was to notify the list owner, not to add IP to the blacklist.
> Like I said in that thread, yes, I think that is a somewhat problematic
> practice - which is why I don't block with UCEPROTECT.

Yep, me neither, but I had some cases of dimwitted admins setting up
UCEPROTECT RBL so I couldn't even contact the postmaster! (the whole /14
range my server is in is listed in level-2 - that's ridiculous).
So I advice whenever I can that people _don't_ use UCEPROTECT.

--
\------------------------/
| Kruk [at] epsilon |
| http://epsilon.eu.org/ |
/------------------------\

per at computer

Nov 27, 2009, 2:20 AM

Post #13 of 17 (1205 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Mariusz Kruk wrote:

> Every respectable RBL has _clear_ rules of
> 1. Listing

Hmm, I'm not so sure - how about spamcop, surbl, uribl, spamhaus? Their
rules are exactly as clear or unclear as those of uceprotect.

http://www.uceprotect.net/en/index.php?m=3&s=3

I too _would_ like to know how the data is collected, coz' that would
enable me to increase the scores (assuming I agree with the
policy/method), but the policy as described are sufficient for me to
use the data.

> The problem is not in the fact of running RBL as such. The problem is
> in misleading people to use this service and using it to gain
> advantage over people forcing them to pay money.

How do you see UCEPROTECT misleading anyone? I think they're actually
being more open/explicit about their policies than some providers I can
think of.

> Oh, and BTW, http://www.uceprotect.net/en/index.php?m=2&s=0
> See the 15th question's response. I don't know about you but for me
> 'anonymous circle of well-known people' seems kinda oxymoronic.

Not at all. I have a circle of friends that are well-known to me - when
I don't tell everyone who they are, they are anonymous.

> And another BTW. I found a mailinglist discussion about UCEPROTECT in
> which you also took part (no, I wasn't looking for you :->)
> http://lists.swinog.ch/public/swinog/2008-January/002432.html
> Don't you think that manually adding someone to a blacklist (for free!
> *evil grin*) is tampering with it without clear rules? The guy with
> the autoresponder was surely causing some inconvenience but the proper
> response was to notify the list owner, not to add IP to the blacklist.

Like I said in that thread, yes, I think that is a somewhat problematic
practice - which is why I don't block with UCEPROTECT.

/Per Jessen, Zürich

uhlar at fantomas

Nov 27, 2009, 3:25 AM

Post #14 of 17 (1206 views)
Permalink

Re: UCEPROTECT questions [In reply to]

> Alex wrote:
> > I'm interested in people's opinion of UCEPROTECT. I'm aware of how it
> > works, but even UCEPROTECT1 seems to catch an awful lot of ham, and I
> > wondered if I was doing something wrong.

On 26.11.09 23:09, Per Jessen wrote:
> Don't use UCEPROTECT for catching, only for scoring.

well, there are some postmasters/hosts using even L2 and L3 at SMTP time for
rejecting.
We have ticket open where a host is rejecting your mail because IP in
Received: is in backscatterer.org.

Some people don't know what they are doing.
--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
"They say when you play that M$ CD backward you can hear satanic messages."
"That's nothing. If you play it forward it will install Windows."

per at computer

Nov 27, 2009, 4:21 AM

Post #15 of 17 (1207 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Mariusz Kruk wrote:

> But yes, some other RBL's have also unclear rules - I admit.
> Yet, the delisting is kinda different isn't it?

Yes, but that has not been a problem for me so far. As far as I can
tell, the automatic process also works very well.

>> - which is why I don't block with UCEPROTECT.
>
> Yep, me neither, but I had some cases of dimwitted admins setting up
> UCEPROTECT RBL so I couldn't even contact the postmaster!

Yeah, there is no shortage of poorly configured mailservers - missing
rDNS, no postmaster/abuse address, poor HELOs, even illegal
IP-addresses on the internal networks. It's a sad state of affairs.

> (the whole /14 range my server is in is listed in level-2 - that's
> ridiculous).

Now I understand your problem - I have 15 IP-addresses from that network
on my internal list generated from spamtraps. The last one only three
hours ago.

/Per Jessen, Zürich

per at computer

Nov 27, 2009, 4:21 AM

Post #16 of 17 (1205 views)
Permalink

Re: UCEPROTECT questions [In reply to]

Matus UHLAR - fantomas wrote:

>> Alex wrote:
>> > I'm interested in people's opinion of UCEPROTECT. I'm aware of how
>> > it works, but even UCEPROTECT1 seems to catch an awful lot of ham,
>> > and I wondered if I was doing something wrong.
>
> On 26.11.09 23:09, Per Jessen wrote:
>> Don't use UCEPROTECT for catching, only for scoring.
>
> well, there are some postmasters/hosts using even L2 and L3 at SMTP
> time for rejecting.

I have no doubt there is. Doesn't change anything for uceprotect, imo.

> We have ticket open where a host is rejecting your mail because IP in
> Received: is in backscatterer.org.

Yeah, I know (which ticket is this?)

>
> Some people don't know what they are doing.

Too many, unfortunately.

/Per Jessen, Zürich

uhlar at fantomas

Nov 27, 2009, 5:02 AM

Post #17 of 17 (1202 views)
Permalink

Re: UCEPROTECT questions [In reply to]

> >> Alex wrote:
> >> > I'm interested in people's opinion of UCEPROTECT. I'm aware of how
> >> > it works, but even UCEPROTECT1 seems to catch an awful lot of ham,
> >> > and I wondered if I was doing something wrong.
> >
> > On 26.11.09 23:09, Per Jessen wrote:
> >> Don't use UCEPROTECT for catching, only for scoring.

> Matus UHLAR - fantomas wrote:
> > well, there are some postmasters/hosts using even L2 and L3 at SMTP
> > time for rejecting.

On 27.11.09 12:56, Per Jessen wrote:
> I have no doubt there is. Doesn't change anything for uceprotect, imo.
>
> > We have ticket open where a host is rejecting your mail because IP in
> > Received: is in backscatterer.org.
>
> Yeah, I know (which ticket is this?)
>
> >
> > Some people don't know what they are doing.
>
> Too many, unfortunately.

I'm only saying that anyone publishing a RBL SHOULD know what is he doing
and that some people apparently will use it for anything therefore (s)he
should be carefull enough about publishing it.
--
Matus UHLAR - fantomas, uhlar [at] fantomas ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Save the whales. Collect the whole set.

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads