ORBS BS

The ORBS Behavior Modification Site

So, your system administrator has chosen to subscribe to ORBS? If you're reading this page, I tried to send you email in response to something you sent me, and couldn't because of ORBS.

This page gives some reasons why ORBS in its current incarnation is bad, and what you can do to fix your site.

Spam and open relays

Is it good to try to prevent spam?

Sure. Spam is very irritating, and wastes time for the mail administrator and the site's users.

Is it good to prevent my site from being an open relay?

Sure. If your site is an open relay, you may spend time dealing with your mail servers when they become overloaded by spam delivery, and you may spend time dealing with irate recipients of spam that has been delivered using your mailer.

Is there ever a reason for an open relay?

Many sites use open relays to serve their mobile users. Mobile users configure their laptops to use a relay, then travel off-site and use their laptop with a distant Internet connection. An unlikely alternative would be to teach every user at the site how to reconfigure their mail host every time their laptop roams.

Karsten Thygesen gives an alternative solution that allows a site to mostly close their relay:

Many sites with laptop users configure their email system to allow open relaying to an user's IP number one hour (or longer) after he used pop or imap - that way you know that it was your user, and where he came from. Many sites use this policy.

Is ORBS a good solution?

In its current incarnation, no, because ORBS only rejects incoming mail.

Consider what happens when user A at your ORBS-subscribing site sends mail to user M (me!) at an ORBS-offending site. I (M) spend time composing a thoughtful reply to A. I send my composition. It bounces, and I receive notice. I'm just a user. I can:

drop my careful composition in the mailbox, and grumble at A for being so inconsiderate as to request something to which I can't reply. (This is a lot like a spammer's fake return address, isn't it?)
spend an hour playing with telnet site smtp to get the message through from a non-blacklisted IP address.
lean on my sysadmin to close our open relay and get us out of ORBS.

The latter is exactly the goal of the ORBS project. But am I likely to do this? No! I consider the time I took composing my message generous enough; why should I spend my good will with my sysadmin just to get a message to your site?

And A is left to conclude that M is an inconsiderate jerk who is too lazy to reply to A's message.

Alan Brown (ORBS admin acct ) writes:

If you want your mailserver to be open, so be it. Don't expect substantial parts of the rest of the world to not fence your security problem out of their collective backyards.

The problem with Alan's fence is that it's one-way, and most of the people (users like A) on the inside of the fence don't even know it's there. So they attempt to speak casually with their neighbors in the next yard, and can't understand why the neighbor is so rudely ignoring them.

Can ORBS be fixed?
I'm of the opinion that blacklisting is a poor solution, even temporary, to the problem. In my opinion, for the sake of your users and the users they communicate with, you should not use ORBS.
If you decide you must, here are some proposed improvements. If your site is involved in ORBS, please find a way to contribute these improvements to the ORBS world:

Inform all of your users regularly that you are an ORBS subscriber.

Make sure they realize that this will sometimes mean silent (to them) nondelivery of replies. Make sure they include their phone number in their .signatures, since email won't work for a significant fraction of their correspondents.

Bounce outgoing mail to ORBS-offender sites.

In many cases, this will inform A right away that attempts to communicate with M by email are doomed. It will prevent A from signing up for mailing lists and sending messages about "why is this list so quiet?" It won't always work, since the outbound mail route isn't always the same as the inbound route.

Notify your users of attempts to reach them.

Whenever you bounce incoming mail, send a short message explaining ORBS to the intended recipient, as well. This way, user A has an opportunity to call user M directly, or send email with A's phone number to M. This would go a long way toward solving the main problem with ORBS, that it silently severs lines of communication.

Participate in efforts to write a new authenticated mail protocol.

Help stamp out ORBS by eliminating the base problem.

Who wrote this page, a spammer?
Um, no. I'm just an email user. I have spent my share of time irate at spammers. But in the end, I can hit 'D' and dispense with the problem in short order. In contrast, ORBS causes me much more pain. I run a mailing list for some software I maintain. When users at ORBSed sites subscribe, I have to kick them off the list because list mail to them bounces. When they send mail to the list, the replies I spend time composing are wasted, because I can't deliver them to the original sender. And I have no way of telling the original sender this. All this trouble to save me from spam? Spam is bad, but ORBS isn't the solution.
Don't use this address unless your site will accept replies from it: jonh@cs.dartmouth.edu