Subject: Re: [Asrg] filtering at connect time

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Wed, 05 Mar 2003 09:00:00 +0700

On Tue, 4 Mar 2003 13:17:14 -0700 (MST), Vernon Schryver wrote:

>That is not right.  People who operate relays may be less culpable than
>the original senders of spam, but they are certainly blame worthy
>and they are certainly not victims in the same class as spam targets.

The term of art is 'contributory negligence'

Jeffrey Race

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Tue, 4 Mar 2003 18:33:37 -0800

> The term of art is 'contributory negligence'

That is the term, but only a very few years ago open relays were
the norm, even the polite thing to do.  Until people came up with
kludges like smtp-after-pop, they were even the approved way to
help your users who roamed around the network.  So in the law it's
quite a leap from moving something from expected norm to negligent
in just a few years.

The draft I proposed allows open relays for those who wish to use
them, though they can't run mailing lists from them.  So I suggest
it is not inherent that open mail relays must be closed.

Plus it's an interesting precedent.  For example, if you run MS
Windows as found on the CD, your machine can be invaded and used
as a base for DDOS.  Should you be sued over this?  Should Microsoft?
What about after patches become available?

It's messy.

Anyway, the point is the open relay operators are not doing things
deliberately.  They don't want to relay spam.  They are spammer's
victims.  If possible, we should try to help them.   Forcing them
all to close is something to be done only if we have exhausted all
ways to solve the problem.

Plus there are "open" relay operators who state they have put in
throttles which stop spammers (or anybody untrusted) from sending
large volumes of mail through the relay.  Yet the blacklist relay
testers don't test a large volume, they test a single message, and
blacklist the relay even though it is not practical for spammers
to use it.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 04 Mar 2003 21:21:18 -0600

In <[email-masked]> Brad Templeton <[email-masked]> writes:

>                                                      Forcing them

Well, you may need to start thinking about creating a "Save the Open
Relay Society" or something.

One of the DNSBLs that lists open relays is ordb.org and it keeps
stats on the number of open relays.  It was created after orbz(?) was
shut down, and in the first six months, it went from zero to around
200,000 listed open relays.  In the last 12 months, it has stayed
around 200,000 and is actually falling.  This is despite having
hundreds or even thousands of new sites being listed every day.

Does any major MTA have a default of being an open relay any more?
Are there still new ways of tricking MTAs into relaying regularly
being found?

I suspect that the number of open relays has reached a peak and will
now gradually decline as people upgrade their software.  (Yeah, this
will take years, but...)

-wayne

---

From: "Brad Davis" <[email-masked]>
Date: Wed, 5 Mar 2003 06:56:30 -0800

> What about after patches become available?

What if my car, as purchased, and after a recall notice, could detonate,
taking out a highway overpass?  Should I or the manufacturer be liable.
Endangering shared resources is endangering shared resources.

Brad Davis

---

From: "Chris Lewis" <[email-masked]>
Date: Wed, 05 Mar 2003 10:00:47 -0500

> the norm, even the polite thing to do. 

There are many things that once were okay, or at worst ignored, and are 
now as much as outright illegal.

You used to be able to get a full Usenet feed at 300 baud.

Society moves.  The Internet moves faster than most things.

> victims.  If possible, we should try to help them.

Agreed.

I firmly believe that blacklisting open relays being used to spam is one 
of the simplest and most effective ways to help them notice they have a 
problem.  Trying to contact relay owners is usually a waste of time due 
to poor WHOIS practises. Demonstrating that running an open relay has 
real consequences is what gets them to pay attention and fix their problems.

Blacklisting relays generates the occasional false positive here - but 
our infrastructure takes special steps to ensure that any rejection is 
seen, with instructions on what to do to rectify the situation.

In that sense, our system has no false positives - there's always a 
means to get the email through. Just may take you two tries.

> ways to solve the problem.

That's silly.  The problem _is_ that they're open and usually being used 
to spam, and the quickest and most appropriate way to solve the problem 
(in 99.99% of the cases) is to close them.  Ignoring a spam hydrant does 
nobody any good.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:24:42 -0500

> I firmly believe that blacklisting open relays being used to spam is
> one of the simplest and most effective ways to help them notice they
> have a problem. 

arrrgh.

we used to run an "open relay".  we had measures in place to keep it
from being used by spammers, and they worked.  but it would pass the
blacklisters' tests for open relays, so we got blacklisted.  and people
started to refuse mail from us.

as far as I am concerned the blacklisters have done a lot to hinder
delivery of legitimate mail, a lot to make it more difficult for mobile
users, and almost nothing to reduce the amount of spam.

they're worse than the spammers, and I would support the death penalty
for spamming. 

Keith

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 10:38:53 -0500

> >blacklisters' tests for open relays, so we got blacklisted.  and
> >people started to refuse mail from us.
> 
> Could you elaborate a bit about the measures you used to prevent is
> use by spammers?

we counted the number of non-local recipients of mail sent through our
relay from non-local, unauthenticated users.  we would only allow a few
recipients (I think the number was 15) from any one IP address per day. 
this was sufficient for our mobile users, who sent only a few messages
per session, most of which were to local recipients.  but it was a small
enough number to discourage spammers from using us as a relay.  a couple
of them tried it, but gave up when only a few messages got out. 
actually we were pleased that they wasted their time trying to use our
relay :)

> I'm not sure why open relays are useful now... don't all networks/ISPs
> have local SMTP servers these days?

it's a pain in the wazoo to have to change your SMTP server every time
you connect to a different network.  

authenticated submission is a better fix.  but it's still not widely
used.

Keith

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 5 Mar 2003 12:15:20 -0500 (EST)

> you connect to a different network.  

There is something to this line of argument. However necessary the closing
of open relays is (and I agree that it is), none of the methods for
solving the roaming user problem is a easy as it should be. Authentication
(without plaintext password) is quite complex at the MTA, and not default
at the MUA.  SMTP after POP is complex at the MTA, especially if POP and
SMTP occur on different servers. Some of this will cure itself in the
fullness of time, as these procedures become widely adopted. They don't
need to be hard.

I think a simple standard could eliminate the pain of changing smtp hosts 
for each ISP used.

Isn't there an RFC that suggests "mail" as the hostname for the SMTP
server? I seem to remember that, but it is hard to search for such a
common word, and I can't find it now. In any case, if each ISP established
a CNAME of "mail" that accepted local mail for relay, users could just
put that in the smtp server field of their MUA, and could leave it
no matter what ISP they were connecting through. The resolver on
the personal computer would add the correct local domain. No protocol
change at all.

Of course, the ISP might need a lot of CNAMES, if it had lots
of subdomains, such as mail.ne.mediaone.net, mail.nw.mediaone.net, etc.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 13:26:40 -0500

> I think a simple standard could eliminate the pain of changing smtp
> hosts for each ISP used.

the SUBMISSION protocol (basically SMTP on another port, but requiring
authentication) is simpler than that.  see RFC 2476.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Daniel Feenberg <[email-masked]>
Date: Wed, 5 Mar 2003 16:01:28 -0500 (EST)

> authentication) is simpler than that.  see RFC 2476.

We have implemented a submission port, but it is hardly a panacea. Outlook
only supports plain text passwords (which is a step down from no
passwords, in my opinion) and Eudora requires installing the "esoteric
features" (which are not part of the default install). It does have the
advantage that it by passes outbound port 25 blocks, which is why we use
it. I believe this is an excellent long run solution, but till the MUAs
take it seriously, it will be hard to impose it on recalcitrant operators
of open relays.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 16:34:39 -0500

> > the SUBMISSION protocol (basically SMTP on another port, but
> > requiring authentication) is simpler than that.  see RFC 2476.
> 
> We have implemented a submission port, but it is hardly a panacea.
> Outlook only supports plain text passwords (which is a step down from
> no passwords, in my opinion) 

surely it does plain text over SSL/TLS?  it's hard to do better than
that, as the other solutions (keyed hash functions, client certs,
kerberos) require new infrastructure that usually isn't in place.

> I believe this is an excellent long run
> solution, but till the MUAs take it seriously, it will be hard to
> impose it on recalcitrant operators of open relays.

we haven't found passwords-over-SSL to be terribly onerous.

Keith

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 18:13:02 -0500

>features" (which are not part of the default install). It does have the

I don't believe that either of those are true anymore.  Certainly 
Outlook supports MSN authentication, if nothing else.  And AUTH MSN 
is simply AUTH NTLM renamed (idiots).  A fact with some MTAs are 
already taking advantage of (Communigate supports it, and we just 
patched Courier to support it as well.)

-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg