Software Testing Blog

In Part II of our interview with Michelle Sullivan we discuss the future of spam blocking; whether or not blacklists or algorithms are still the best spam prevention method; the dreaded SORBS fine; and how Michelle would change email if she could. If you missed Part I of the conversation, you can find it here.

uTest: SORBS catches a lot of flack for some of its heavy tactics, like fines. Do you think these tactics work, as opposed to more educational or consultative approaches? Is there room for both?

MS: We have also gained some real support for taking such a hard line.

The SORBS fine does not exist any more.

With the deployment of SORBS v2.0 we have discontinued the fine; instead we are taking a time-based penalty approach. I have in the past been a supporter and a hater of the SORBS fine, which often confused people. I hated having it, but saw no other option. I believe that people running the servers for spammers, whether knowingly or unknowingly (e.g., by having a robot on their machine) or ISPs and hosters running the DNS and webservers for profit are responsible for the spam in their own way. I feel that those people need to be encouraged to take a more responsible and active role in the prevention of spam by proactively ensuring their machines do not participate in botnets, that their sales staff do not sell ‘pink contracts’, etc. The fine outraged many people, until they realised that:

• SORBS never received a penny of the fine
• They wouldn’t likely have actually done anything if they could ‘just delist’
• Policies for some very large ISPs of the world have changed because of it

uTest: People seem to have a love/hate relationship with blacklists. On the one hand, they cut down on a lot of spam. On the other hand, nobody wants to be a false positive. The consequences of having a mail server accidentally be blocked can be catastrophic for a business or individual. What kinds of processes does SORBS use to make sure each listing is legit?

MS: This goes back to my previous comments on transparency all the submission systems for SORBS v2.0 are based on specific events, and they are automated, this means that there is virtually no possibility of error. Of course this doesn’t mean a thing if your error-free data is mangled on transfer when performing a migration, but within normal SORBS operation every piece of data is signed by the host in a way that is easily detectable that the host sent the data and it is un-tampered with. Should the tamper check fail, we discard the information, even if it is legitimate. This helps us ensure that the data in the database is always correct at time of insertion.

uTest: The Internet has grown and changed a lot since the creation of the first blacklist. With so many people using email for all kinds of communication, do centralized blacklists still make the most sense as spam prevention mechanisms?

MS: Defense in Depth is the key to the whole debate. No one blacklist should be used without careful consideration. No one non-blacklist method should be used without careful consideration. This does not mean that it is wrong to use SORBS as the only external blacklist, it means you should be using SORBS with other technologies (such as a local or global whitelist) as appropriate to your systems.

To give an example, I use SORBS on my mail server at home, I also use a variety of DNS, recipient and sender verification checks. Each of these methods are “make a match and you’re blocked” rules, however I have a set of rules that precedes the blocking rules that say, “if it looks like this, it might be ok” or “if it’s from here, skip this check”, etc. Net result is at home, and with GFI MailEssentials I receive virtually no spam in my Inbox, and those that get past the initial checks are routed back to SORBS to improve the catch rate for SORBS users. The connection rate to my poor old mail server is averaging some 100,000-150,000 connections per day, were I actually receive about 50-100 non spam emails out of that.

uTest: Should we, for example, be putting more faith in algorithms?

MS: You need to evaluate the problem you face and take appropriate action, if this means using algorithms then you should use them. I use blacklists, heuristics and some very special personal algorithms on my home server, so I don’t see why you shouldn’t. The important part as I mentioned before is that you should not rely on a single method, especially as there are products like GFI MailEssentials that will combine the many methods into an easy-to-use central interface.

uTest: What kind of tech runs behind the scenes at SORBS?

MS: As with any large database and web system there is a centralised cluster of servers that are used to analyse incoming data as well as provide reporting and distribution capabilities. Outside the central cluster, the systems are distributed to as many networks as possible in as many geographically separate locations as manageable. This is to assist resilience whilst maintaining a good level of control. It is not uncommon for SORBS servers to be attacked by Distributed Denial of Service attacks and as such we have made the systems as redundant and as distributed as possible.

Actual technical specs are naturally confidential, but the SORBS v2.0 database runs on the PosgreSQL relational database and the new SORBS v2.0 website and systems run on more than 78,000 lines of perl code (not including the monitoring (nagios), support (Request Tracker) or database replication software (Bucardo) which is provided by others.)

uTest: How many people contribute to the operation?

MS: There are two distinct parts of SORBS: the volunteers and the GFI staff. We have five very active volunteers and several part-time volunteers. We have myself and Katie, the full-time SORBS support person, and we have the management of GFI and a number of other staff (researchers, marketing, and technical writers) that have worked on SORBS or are working on SORBS.

uTest: If you could change the way email works in this world, what would you do?

MS: I don’t think I would change it, I have thought long and hard about the problem of spam and viruses and have come to the conclusion what makes email work is what enables the viruses and spam in the first place. I can see no way around it.

Email systems have to allow ‘unknown’ connections that can say they are who they are completely anonymously. There is no option in that respect, and as such the spammers can use this core functionality against us.

Options that I have considered are a ‘web-of-trust’ type email system, where you only trust your neighbours; this would work well, except when it comes to new servers and new domains. How would anyone ever send mail from a previously unknown location? Of course if there is a method to counter this, the spammers and virus creators would exploit the method to spread their rubbish.

Centralised and decentralised authentication mechanisms are a great idea (particularly the latter) but again suffer similar flaws, if its centralised there is a single point of failure and if it is decentralised, there is the problem of administration of who gets to do what and can spammers get into it (this is very similar to web-of-trust.)

Pay-for-delivery models would stop spammers in their tracks if the cost is high, but the problem is the administration of who pays what, and what happens if the world’s largest email providers say, “we don’t like you, so if you want to send email to us, it’ll cost you $100 per email” or some similar scenario. How does a home user, or small business collect from the likes of AOL or Hotmail, and what happens if gmail says, “we’re not going to accept mail unless you have $10,000 credit with us” etc?

Governmental administration wouldn’t help either; yes sure there would be many more jobs created just in the administrative overheads, but really which government would control the pricing and services? The whole idea is a non-starter in so many ways.

The Internet was made to be resilient and to enable messages to be able to take many different paths so that they get through. This is what makes both the Internet and email so good, so useful and so revolutionary. To change the way it works would change the core of what it is, we have to take our hands off it and stop the spam via more traditional methods: Put the miscreants in jail, stop them making money, make it too costly for the business model to work and hopefully they’ll go do something more useful instead.

Best regards,

Michelle Sullivan
SORBS Engineering Director
GFI Software

Editor’s note: We hope you enjoyed our two-part interview with Michelle Sullivan. If you have an idea for a future interview, send your suggestions to marketing@utest.com.