This Blog Is Not For Reading

A blog, just like any blog, only more so

  • Subscribe

  • Categories

  • RSS Bob Jonkman’s Microblog

    • Favorite 17 July 2019
      bobjonkman favorited something by wolfie: @ink_slinger also "blood is thicker than water" is actually short for "The blood of the covenant is thicker than the water of the womb" which means that friendship formed in hardship is stronger than family bonds, the exact opposite of the shorthandAnd curiosity killed the cat used to stop people […]
    • Favorite 17 July 2019
      bobjonkman favorited something by inkslinger: "Pull yourself up by your bootstraps" was originally satire because that is, um, impossible. It's now stated without irony."Just a few bad apples," when referring to police, conveniently ignoring the full aphorism ials actually: One bad apple *spoils the bunch.*
    • Favorite 27 June 2019
      bobjonkman favorited something by selfcare: Fix something small that gets in your way. Sew on a button, clean a grimy keyboard.
    • New note by bobjonkman 27 June 2019
      Just this once, only for this video and no other, should you #ReadTheComments!https://youtu.be/1OfxlSG6q5Y
    • bobjonkman repeated a notice by gudenau 27 June 2019
      RT @gudenau @dirb @Loki This is what a real toaster is like. https://youtu.be/1OfxlSG6q5Y
    • Favorite 27 June 2019
      bobjonkman favorited something by gudenau: @dirb @Loki This is what a real toaster is like. https://youtu.be/1OfxlSG6q5Y
    • New note by bobjonkman 25 June 2019
      I wish I had seen that article on Switzerland's Housing Co-ops this morning before I did this: https://radiowaterloo.ca/ckms-community-connections-for-24-june-2019
    • bobjonkman repeated a notice by neil 24 June 2019
      RT @neil Despite a lot of interest, there’s only a small amount of co-op housing in the UK. Most non-profit housing is charitable housing associations. Large housebuilders have a hold of the market overall."the Swiss example shows how these non-state and non-capitalist actors can build quality housing at a mass scale, if they’re encouraged — […]
    • New note by bobjonkman 12 June 2019
      Discrimination against atheists goes to BC Human Rights Tribunal: https://www.cbc.ca/news/canada/british-columbia/byron-wood-nurse-12-step-religious-discrimination-complaint-1.5172488 #Atheism /cc: @indi
    • bobjonkman repeated a notice by davehunt 9 June 2019
      RT @davehunt !joke Yesterday, I ate a clock. It was time consuming.

Blocking port 25 considered harmful

Posted by Bob Jonkman on December 10th, 2008

Coffee cup with a broken handle on a cluttered desk

Coffeine abuse by maciekbor

Over in the Teksavvy Forum at DSLReports Rocky Gaudrault, the owner of my ISP, Teksavvy, started a discussion on blocking port 25 entitled “Argg…. UCEPROTECT… very frustrating!“. This is my reply:

Two cents I’d like to contribute:

The UCEPROTECT service isn’t blocking e-mail, it merely provides an opinion on an IP’s reputation as a mail server. Technically, this opinion is expressed with a DNSBL.

When mail doesn’t get delivered, it’s the receiving mail server that blocks it, not UCEPROTECT. The recipient may reject the mail based on the opinion of the DNSBL, but if that DNSBL gives bogus information then the recipient will be blocking legitimate mail. The fault is with the mail recipient for choosing a poor DNSBL. It’s not Teksavvy customers who can’t send e-mail, it’s the recipients who are refusing to accept it.

Even if Teksavvy did block port 25, there’s no guarantee that poor DNSBL services would whitelist Teksavvy’s servers. DNSBLs are run at the whim of their operators, and they can blacklist anything they like. The people who use these services need to understand that they’re letting someone else decide what mail they can receive, completely out of their control.

Port blocking is ineffective as a spam fighting technique — ISPs started port blocking in 2001, but if port blocking is so good, why is there still spam? Most spam still comes from disreputable bulk mailers running large-scale operations. Remember the McColo servers from a few weeks ago? When that one operation was shut down there were reports that spam volumes dropped by 30%. To fight spam, concentrate on the large-scale spammers.

There are lots of spambots running on poorly protected home computers, but that’s a symptom of poor security. Blocking port 25 won’t fix the security problem. To fight poor security it’s far better to identify the compromised computers, and provide them with tech support to fix the problem. Teksavvy is in a better position to do that than any other service provider I know.

There is no benefit to Teksavvy customers in blocking port 25 — It doesn’t protect Teksavvy customers from spam. It might protect other ISP’s customers from Teksavvy spammers, but it also denies Teksavvy customers full access to the Internet. Full, unblocked access is one of the main differentiators that Teksavvy brings to the market. Don’t give that up, Rocky.

Blocking ports also prevents legitimate services. ESMTP extensions like DSN rely on a direct connection to transfer Delivery Status Notifications. If a relay server doesn’t implement DSN then status notifications don’t get through. If port blocking is turned on, the smart host providing the relay service had better implement every ESMTP extension that exists. And that could still block other services that rely on unfettered access to port 25 (iMIP anyone?)

Blocking one port today is the thin edge of the wedge to blocking other services. Already I’ve seen requests for blocking ports 137 and other Netbios ports. If Teksavvy starts port blocking then every time there’s a new vulnerability the Teksavvy execs will need to agonize over whether to block or not. DNS is broken? Block port 53. There’s child porn on Usenet? Block port 119. CRIA threatens to shut down encrypted filesharing? Block port 443. If Teksavvy has a policy of no port blocking, all these decisions are moot.

I left Rogers because of port blocking, and came to Teksavvy because of unfettered access. Please don’t take that away.

–Bob.


Coffeine Abuse by maciekbor is used under a CC-BYCreative Commons Attribution license.

 
Better Tag Cloud