AOL wary of Comcast, Road Runner mail

[Dave Farber <dave () farber net>]

------ Forwarded Message
From: "DL Neil, Mail list account" <IP () dande homechoice co uk>
Date: Mon, 14 Apr 2003 15:22:35 +0100
To: dave () farber net
Subject: AOL wary of Comcast, Road Runner mail

AOL wary of Comcast, Road Runner mail | CNET News.comDave,
For IP.
> From the pot-calling-the-kettle-black department.

It is claimed that America Online has started blocking what it deems to be
suspicious e-mail sent directly from email servers attached to certain
broadband services (cf email from the ISP's SMTP servers in customer-relay
mode).

Are AOL really prepared to penalise sophisticated users or make them
'collateral damage' in the war against spammers (funny how the spammers
attacking me seem to prefer to use AOL as launchpad rather than target), and
are they seriously attempting to limit/regulate the usage of other ISP's
networks for them? I assume that Comcast and RoadRunner are but the first
targets of such a policy.

Will be interested in IPer comments, and what AOL members can tell us of
their pressing need.
=dn


Original URL: http://news.com.com/2100-1024-994992.html
and http://zgp.org/pipermail/linux-elitists/2003-April/006046.html
Also Slashdotted at http://slashdot.org/article.pl?sid=03/04/13/2215207


AOL wary of Comcast, Road Runner mail
By Stefanie Olsen
Staff Writer, CNET News.com
April 1, 2003, 1:57 PM PT

In its latest attempt to crack down on spam, America Online has started
blocking what it deems to be suspicious e-mail sent by customers of
Comcast's High-Speed Internet and AOL Time Warner's Road Runner broadband
services.
AOL, the interactive arm of AOL Time Warner, began in the last week to
reject some e-mail sent by users of those services, according to AOL. AOL
and Comcast, in particular, have worked together to identify a range of
Internet protocol addresses of Comcast customers who have set up their own
mail server to send messages, as opposed to using Comcast's mail servers
like most subscribers do.
AOL began censoring messages originating from those IP addresses, stopping
designated Comcast subscribers from sending mail to AOL members.

The tactic serves to foil spammers that set up their own mail servers to
send millions of unsolicited messages via Comcast's big pipes--a practice
that helps better disguise the junk mail. Spammers are increasingly
attracted to piggybacking on high-speed pipes to send spam because they can
send more, and by using their own mail server, they can bypass the
spam-detection measures that ISPs use on mail before it's sent on their
networks. However, this antispam tactic can, in some cases, prevent
legitimate mailers from contacting friends or colleagues with an AOL
address.
"Those customers who are using their own residential mail relays to send
e-mail to AOL members have been identified by their dynamically assigned IP
addresses as a source of spam by our members, and we have taken action to
thwart their illicit activity to protect our members' online experience,"
AOL spokesman Nicholas Graham said.
Graham added that legitimate Internet users of AT&T/Comcast will continue to
be able to send e-mail to AOL members "as long as they are using the normal
channel of mail relays operated by AT&T and/or Comcast to send their
e-mails."
Like many other ISPs, AOL has stepped up efforts to squelch spam in recent
months as the problem has grown to epic proportions and has easily become
the No. 1 nuisance to Web users. According to a December 2002 study by the
Gartner Group, as much as 50 percent of all messages in a given corporate
in-box are unwanted e-mail--a rate that's sure to grow.
AOL's blocking of rivals' open mail servers is the latest among many other
tactics used to fight spam, such as filtering technology and lawsuits
against junk mailers. Graham called it the newest "front in the war against
spam and spammers." He said complaints from AOL members reached an all-time
high recently about the amount of spam coming from Comcast's service and
that's when AOL started working with Comcast to block those IP addresses.
Comcast said it fully supports the strategy. "Comcast is cooperating with
AOL in its effort to reduce spam," Comcast spokeswoman Sarah Eder said. "We
recognize that spam is an issue for all e-mail users, and we're working
collectively to combat the problem."
At least one legitimate mailer complained about AOL's move. Nils Puhlmann, a
Comcast subscriber, criticized AOL for interfering with small businesses or
legitimate e-mail like his own. "For people who have set up a private mail
server to send e-mail with a domain name that reflects their family name or
their small-home based business, they cannot send one single e-mail to
anyone with an @aol.com address," Puhlmann said.
"I am an active proponent of antispam measures and believe that people
should be free to choose what services they want to use over their Internet
connection," Puhlmann added. "Especially if they pay nearly $50 a month for
that. No other Internet access or service provider should have the right to
target, block or slow down traffic from competitors by range of IP addresses
instead of targeting certain individuals who violate the rules and harm
others."
Other antispam advocates said the measure is not uncommon, given that many
ISPs share the range of IP addresses that are given to residential accounts
and that are unauthorized for use with separate mail servers.
"It is a useful step in that broadband connections of all kinds are favored
by spammers because they can use high-speed access to pump out more spam
than ever," said Ray Everett-Church, a privacy advocate and Comcast
subscriber. "So there's a real incentive to take measures that deny spammers
benefit from high-speed access."
"It makes a certain amount of sense that customers who are trying to figure
out technology and set up a home server might be a little ticked off. But
the downsides of spammers freely using that network far outweigh that
inconvenience," Everett-Church said.
*****
[linux-elitists] AOL says goodbye to AT&T/Comcast and residential mail
spools
Aaron Sherman ajs () ajs com
10 Apr 2003 23:19:39 -0400

Hope no one here has friends or relatives that use AOL if you run your
home MTA on a residential network.... If you do, you'll have to start
relaying mail for AOL through the public relay (probably slow and flaky)
that your ISP provides. Why?

AOL has instituted a new policy: TCP sessions established on port 25 to
any of their MX hosts from systems that obtain their IP addresses
dynamically (their term, I don't know exactly how they define it, since
I'm not on any reputable, public dynip BLs that I can find) will be
summarily disconnected after the transmission of several lines of text
which resemble an SMTP error.

I say "resemble" because the SMTP RFC is clear on their options at this
point in a session (e.g. after the transport session has first been
established):

   The SMTP protocol allows a server to formally reject a transaction
   while still allowing the initial connection as follows: a 554
   response MAY be given in the initial connection opening message
   instead of the 220.  A server taking this approach MUST still wait
   for the client to send a QUIT (see section 4.1.1.10) before closing
   the connection and SHOULD respond to any intervening commands with
   "503 bad sequence of commands".  Since an attempt to make an SMTP
   connection to such a system is probably in error, a server returning
   a 554 response on connection opening SHOULD provide enough
   information in the reply text to facilitate debugging of the sending
   system.

AOL violates this on two major points:

1. They issue a series of 550 responses, not 554, like so:

550-The IP address you are using to connect to AOL is either open to
550-the free relaying of e-mail, is serving as an open proxy, or is a
550-dynamic (residential) IP address.  AOL cannot accept further e-mail
550-transactions from your server until either your server is closed to
550-free relaying/proxy, or your ISP removes your IP address from their
550-list of dynamic IP addresses.  For additional information,
550-please visit http://postmaster.info.aol.com.
550 Goodbye

2. They then send a reset packet to disconnect the session.

I'm going to look into what it takes to get a site on the various
RFC-non-compliance lists, but ultimately, the RFC lossage is not my core
beef (though it certainly is indicative of an attitude that has lead us
down this path). My concern is that more and more companies and
individuals are slicing out those portions of the Internet that they
don't think that they would ever want to interact with in relatively
blind and poorly managed ways.

You cannot, for example, get your well-behaved mailer removed from the
list, since even the initial report that they will send you from their
Web-tool is emailed, not to the IP in question, but to root at the
domain that registered the IP with ARIN!

How much further down this path of large ISPs slicing out the "unwanted"
do we have to see before all ISPs will simply stop passing packets past
their own networks which do not originate from their servers or a
"registered business partner" of some sort?

I'm recommending to all of my friends and family that (a) it will be a
cold day in hell before my mailer config is polluted with a special
entry for every ISP that thinks DHCP-assigned IPs aren't really part of
the Internet, and (b) unless they have the swing to change AOL's policy
on this one, they're better off getting an account with an ISP that
might warn them before taking such drastic and harmful actions.

Sorry for the rant, but I'm annoyed as hell over this. Thanks.
*****


------ End of Forwarded Message

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/