How I deal with (false positive) IP-address blacklists...

Theodore Tso <tytso@MIT.EDU> Tue, 09 December 2008 06:21 UTC

Date: Tue, 09 Dec 2008 01:18:29 -0500
From: Theodore Tso <tytso@MIT.EDU>
To: ietf@ietf.org
Subject: How I deal with (false positive) IP-address blacklists...
Message-ID: <20081209061829.GA13153@mit.edu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="gBBFr7Ir9EOA20Yy"
Content-Disposition: inline
User-Agent: Mutt/1.5.17+20080114 (2008-01-14)
Precedence: list
Sender: ietf-bounces@ietf.org
Errors-To: ietf-bounces@ietf.org

This doesn't work for most people, but I had fun composing this
response, and coming just a few weeks after people claiming that
IP-based blacklists work well, and rarely result in false positives, I
felt I just had to share.   :-)

						- Ted

--- Begin Message ---

Hi there.  Your mailer appears to have my one of the addressed used by
primary mailhub, 69.25.196.31 (it reverse-resolves to
www.church-of-our-saviour.org.).  Its primary ip address and hostname
is thunk.org, 69.25.196.29.  You can see who I am here:

	http://thunk.org/tytso

If you use any amount of Linux on your systems, I am the first North
American Linux Kernel developer, and the maintainer of e2fsprogs, the
filesystem utilities for ext2/ext3/ext4.  This bounce took place
because I replied to some user who apparently has a mailbox on
gondor.apana.org.au, on the Linux Kernel Mailing List.

The way I see things, I provde *way* more services to your users than
you do to me, so I don't see any reason to place an international
phone call to get my IP address un-blacklisted.  If one of your users
or one of your staff members needs my help to fix a Linux kernel
problem, or to unscramble an ext2/3/4 filesystem, or an invite to the
some future Linux Kernel Summit, and they can't receive my e-mail,
that is *your* problem, not mine.

I've arranged to make sure this gets routed via an mit.edu mailhub,
but that's about all I plan to do to resolve this problem.

Your move.

Best regards,

Theodore Y. Ts'o
Linux Foundation Fellow and Chief Platform Strategist
STSM, IBM Linux Technology Center
Medford, Massachusetts
(617) 245-5616
(781) 391-2699 (fax)
(781) 526-0121 (cell)

--- Begin Message ---

This message was created automatically by mail delivery software.
A message that you sent has not yet been delivered to one or more of its
recipients after more than 24 hours on the queue on thunker.thunk.org.

The message identifier is:     1L9Ulw-0001Yz-O5
The date of the message is:    Sun, 7 Dec 2008 20:18:51 -0500
The subject of the message is: Re: Runaway loop with the current git.

The address to which the message has not yet been delivered is:

  herbert@gondor.apana.org.au
    Delay reason: SMTP error from remote mailer after end of data:
    host rhun.apana.org.au [64.62.148.172]: 451-sender IP address 69.25.196.31 is locally blacklisted here. If you think
    451 this is wrong, please call +61289874478.

No action is required on your part. Delivery attempts will continue for
some time, and this warning may be repeated at intervals if the message
remains undelivered. Eventually the mail delivery software will give up,
and when that happens, the message will be returned to you.

--- End Message ---

_______________________________________________
Ietf mailing list
Ietf@ietf.org
https://www.ietf.org/mailman/listinfo/ietf

How I deal with (false positive) IP-address black… Theodore Tso
Re: How I deal with (false positive) IP-address b… Mark Andrews
Re: How I deal with (false positive) IP-address b… Theodore Tso
Re: How I deal with (false positive) IP-address b… Mark Andrews
Re: How I deal with (false positive) IP-address b… Theodore Tso
Re: Why the IETF is irrelevant to the future of e… John Levine
Re: How I deal with (false positive) IP-address b… SM
Re: How I deal with (false positive) IP-address b… Paul Hoffman
Re: Why the IETF is irrelevant to the future of e… Peter Dambier
Re: How I deal with (false positive) IP-address b… ned+ietf
Re: How I deal with (false positive) IP-address b… Dave CROCKER
RE: How I deal with (false positive) IP-address b… michael.dillon
RE: How I deal with (false positive) IP-address b… ned+ietf
Re: How I deal with (false positive) IP-address b… Peter Dambier
Re: How I deal with (false positive) IP-address b… Dave CROCKER
RE: How I deal with (false positive) IP-address b… michael.dillon
RE: How I deal with (false positive) IP-address b… michael.dillon
Re: How I deal with (false positive) IP-address b… Keith Moore
Re: How I deal with (false positive) IP-address b… Dave CROCKER
RE: How I deal with (false positive) IP-address b… Tony Hain
Re: How I deal with (false positive) IP-address b… Dave CROCKER
Re: How I deal with (false positive) IP-address b… ned+ietf
Re: How I deal with (false positive) IP-address b… Keith Moore
Re: How I deal with (false positive) IP-address b… Peter Dambier
RE: How I deal with (false positive) IP-address b… michael.dillon
RE: How I deal with (false positive) IP-address b… ned+ietf
Re: How I deal with (false positive) IP-address b… Rich Kulawiec
Re: How I deal with (false positive) IP-address b… Theodore Tso
Re: How I deal with (false positive) IP-address b… Dave CROCKER
Re: How I deal with (false positive) IP-address b… Paul Hoffman
Re: How I deal with (false positive) IP-address b… Randy Presuhn
Re: How I deal with (false positive) IP-address b… Keith Moore
Re: How I deal with (false positive) IP-address b… Douglas Otis
Re: How I deal with (false positive) IP-address b… John C Klensin
Accountable Use Registry was: How I deal with (fa… Douglas Otis
Re: Accountable Use Registry was: How I deal with… John C Klensin