Subject: Re: [Asrg] Lets Fix Mailing Lists

From: Marco Paganini <[email-masked]>
Date: Sun, 9 Mar 2003 22:55:00 -0500

> (not to the list since you didn't)
 
I'm sending this one to the list.

> > ten or so spammers replying to confirmations. For the paper, I grabbed 500
> > messages from spamarchive.org and sent confirmations to them. 221 bounced
> > back immediately (invalid user, account canceled due to abuse, invalid
> > domain, etc). 17 had invalid addresses (forged as a local address). 260
> > *never* replied (a possible throw-away account). The remaining two were
> > actually "unsubscribe" addresses (someone probably subscribed to one of those
> > web-based forums for a game site and forgot to unsubscribe). As you can see,
> > the percentage of forged address *is* very high.
> 
> No, I do not see that, unless you think 3.4% is very high.  I see no
> evidence showing that 96% of those addresses were forged.
> 
>   - invalid user 
>       could have been terminated for spam

End result: Message not delivered.

>   - account canceled due to abuse
>       clearly *NOT* forged

End result: Same as above.

>   - invalid domain
>       could be forged, but could also be recently expired domains or
>       temporarily bad DNS server (e.g. Ralsky).  I recently ran script over
>       the ~4000 domains in my blacklist, and found about 10% invalid
>       according to the DNS roots.  However, in rechecking, I find that
>       perhaps 60% of those NXDOMAIN answers disagree with what crsnic.net
>       says, which says the domains are valid.  

That is an unusual situation. In the worst case scenario, the challenge would
be lost. This email would sit in my queue where it would be picked up later
during my weekly queue maintenance.

>   - forged as a local address
>      ok you have evidence that 17 of 500 or 3.4% are forged.

Those are definitely forged.

>   - 260 *never* replied
>      if an ASK user sends me a challenge, it is likely that I will
>      never reply.  Thus, this is not evidence of forgery.

But it is an indication that the sender was not available or willing to
confirm delivery of his message. This suggests (in my view) enough evidence
to queue the message for later inspection. I believe (from my experience with
a challenge-based authentication tool over these years) that someone who goes
through the trouble of composing a message will also be willing to reply to a
one-time challenge.

Note that confirmation messages have been used successfully by mailing-list
management software for years (or you're going to tell me that you never
replied to the confirmation sent by mailman when you joined this list ;)).

> I suspect many of the 96.6% for which you do *NOT* have evidence 
> of forgery were forged, but you can't conclude the positive from a
> lack of evidence of the negative.

But the point is: The sender was *not* willing to prove me that he indeed
sent me an email. Either he can't (because the email is not valid) or he
does not care for any reason. I *do* check my queue weekly and, believe me,
finding a false positive is very rare.

> Again, "forged" should mean "spammer has no claim on the address,"
> and not "invalid now but valid before," "doesn't respond to ASK
> challenges," or "IP address doesn't match envelope or headers."

In ASK's case, forged means "I agree that I sent this email and I want
it to be delivered -- I understand that all emails from my address will
be automatically delivered without further confirmations from this point
forward".

> > This seems like an interesting and productive discussion. I'm subscribing to
> > the list. I hope I don't get overwhelmed by emails (I already have around 80
> > emails/day to read from lists, office and friends) :)
> 
> I was travelling the first days the list started.  That was also the peak
> of the usual IETF announce flood of IDs, RFCs, and IESG actions.  It was
> not fun to deal with 500 msgs/day through the primitive ssh tunnel I use.

Eeek!!!

Let's see what happens tomorrow! :)

Regards,
Paga

-- 
Marco Paganini          | UNIX / Linux / Networking
[email-masked]   | PGP: http://www.paganini.net/pgpkey.txt (RSA)
http://www.paganini.net | "Magnus Frater te spectat..."
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 9 Mar 2003 21:16:24 -0700 (MST)

> From: Marco Paganini <[email-masked]>

> ...

Your rules control your mailbox, so the mail you choose to accept is
whatever you like.  

However, I refuse to jump through hoops.  If, as was the case tonight,
you send me a message, I respond, and your computer responds with a
demand that I jump through its hoop to prove I'm not a spam robot, I
will silently refuse.  If you don't want my mail, it would be wrong
for me to whine, beg or jump through hoops.

No, the ASK confirmations are not as someone else said, like subcription
confirmations.  Subscription confirmations say "may I flood your
mailbox with my bulk mail."  ASK confirmations say "prove to me that
you are not a spam robot before I'll deign to read your mail."

> be automatically delivered without further confirmations from this point

Fine, but "forged" is wrong.  In English "forgery" means "an act of
forging; especially the crime of falsely and fraudulently making or
altering a document (as a check)" (See http://www.m-w.com/ )  
It is wrong to say all 96.6% of those correspondents are guilty of
"falsely and fraudulently making or altering" SMTP headers.

This matters because people in this mailing list have been saying
"because 99% of spam is forged, spam defense X won't work/is required."
They are using "forged" to mean "falsely and fraudulently making or
altering" SMTP headers, but I suspect that their numbers are less
convincing than your's.  Your numbers are not guesses or intuition,
although they have nothing to do with "falsely and fraudulently making
or altering."

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Marco Paganini <[email-masked]>
Date: Sun, 9 Mar 2003 23:46:52 -0500

Hello Vernon,

> you are not a spam robot before I'll deign to read your mail."

I'd say that mailing-list confirmations serve two distinct purposes: To warn
the user that his mailbox will be flooded with messages and to protect the
list from mass-mailers.

> although they have nothing to do with "falsely and fraudulently making

OK! Give me another word then and I'll use it! :) 

Regards,
Paga

---

From: Jim Youll <[email-masked]>
Date: Sun, 9 Mar 2003 23:58:44 -0500

>although they have nothing to do with "falsely and fraudulently making

So you've finally come around to the point you've apparently been
trying to make for these past many days without actually saying so.

Can't we just accept that the phrase "forged header" has long been a part of
the e-mail vernacular, as a signifier of message metadata whose contents do
not point back to the true sender, point of origin, and/or subpath by which
the message traveled. Such "forged headers" may point to non-existent senders,
non-existent points of origin, and so on.

Perhaps the phrase should be "forced header," as the common method of 
production of
such "forgeries" is to impose the inaccurate header data over that which would
ordinarily be placed on the message by properly-configured clients and servers.

And if we're going to be pedantic about it, it's worth noting that "forge" may
also mean "to give form or shape to" so you might say that all e-mail headers
are "forged" by server client software. But then I suppose if it's all forged,
there's no point in talking about forged messages at all.

On the other hand, it does seem that when message headers are 
_forged_ by spammers,
they're often _forced_ to bear information that is not useful in finding the
sender or other responsible parties around the sender.

I respectfully request that replies be redirected to asrg.linguistics

---

From: [email-masked]
Date: Mon, 10 Mar 2003 02:16:21 -0500

> the user that his mailbox will be flooded with messages and to protect the

The original (and still valid) reason for these was to catch people who
tried to subscribe using misconfigured MUAs.  Many are the times these
have kept [email-masked]' off my lists. ;)

/Valdis (who sees at least 4-5 mails from [email-masked]' a week ;)

---

From: Matt Sergeant <[email-masked]>
Date: Mon, 10 Mar 2003 08:51:49 +0000 (GMT)

> through the trouble of composing a message will also be willing to reply to a

On the contrary. If I've spent the time to compose an email to someone the 
last thing I want is a bounce back of *any* sort - be it a vacation 
message, an answering machine, or a challenge system.

The infuriate me, and I never respond to them.

Also witness the SpamArrest situation. I bet that we'll see less and less 
people responding to challenge systems because they fear they will be 
spammed at some point in the future by the company running the system.

Matt.

---

From: wayne <[email-masked]>
Date: 10 Mar 2003 08:22:53 -0600

In <[email-masked]> Matt Sergeant <[email-masked]> writes:

> >                                    I believe (from my experience with

Two comments on these "prove you are human" type challenge systems:

First, spamcop.net used to use this system for their email accounts
but dropped it as not being practical.  Things may have changed in the
couple of years since they were doing this, people may be more
understanding about the spam problem and why they are being
challenged, but I kind of doubt it.

Secondly, my ISP recently started to offer this kind of system for a
bargain price of only $1/mo! (sigh)  Their argument for it was it is
great for people who want zero spam, such as accounts for kids.  There
*are* people out there that consider a false negative to be as bad, if
not worse, than a false positive.

-wayne

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 10 Mar 2003 10:42:46 -0500

>the user that his mailbox will be flooded with messages and to protect the

You missed one of the most important ones.  To ensure that the email 
address given to the list actually did ask to subscribe.  It's an 
authentication mechanism, and one I am thankful for everytime some 
virus tries to subscribe me to a mailing list.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 10 Mar 2003 10:54:57 -0700 (MST)

> the user that his mailbox will be flooded with messages and to protect the

No, that last is not a purpose for mailing list confirmations, because
subscription confirmations do not and cannot do that.  Even lists like
this that accept contributions only from subscribers do not depend on
the subscription confirmations to defend against spam.  Subscription
confirmations do just that.  They confirm that a subscription for the
proposed address is wanted, including the pre-spam purpose of ensuring
that the candidate subscriber is using the right address.

> > altering a document ....

> OK! Give me another word then and I'll use it! :) 

Call it whatever you want, but please stop naming with an intentionally
misleading word (albeit probably not by your intention).   "Verified"
or "checked" seems to me close to what you mean, but please feel free
to call it "kumquat" or anything else that is not misleading if that suits.

The use of "forged" for "mismatch between IP address and sender domain"
and similar things that have nothing to do with "falsely and fraudulently
making" is intentionally misleading.  People extend "forged" from the
cases where it is valid (perhaps as low as 3.6% in your data) to other
cases where it is a lie because detecting, discarding, or rejecting
"forged" mail is a good thing.

As I've said many times in this mailing list, contributions to this
list have been rationalizing design requirements by the misleading
use of "forged."  Even if the world of hobbyist spammer fighters (those
who love to count coup on spammers but don't care about reducing spam)
insists on saying that any mail they don't like is "spam" and that
it's all "forged," our standards must be higher.

---

From: Keith Moore <[email-masked]>
Date: Mon, 10 Mar 2003 13:33:37 -0500

>  Even lists like
> the subscription confirmations to defend against spam. 

sigh.  the list may or may not 'depend' on this, but the combination of
subscription confirmations and accepting postings only from confirmed
subscribers does catch a lot of spam ... today.  it might not work so
well once spammers figure out that they can automate sending
subscription requests and confirmations - often they can even arrange
that they not actually get the mail from the lists at the same time.

Keith

p.s. seems like we are having a lot of difficulty understanding each
other due to a lack of precision in our language. words like "spam",
"forgery","legitimate" mean different things to different people.  
the other source of misunderstanding that I've noticed has to do with
assumptions about context.  statements of the form "X won't work"
often seem to carry an implicit "... for purpose Y", which results
in responses of the form "X works just fine" (for purpose Z).
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: mathew <[email-masked]>
Date: Wed, 12 Mar 2003 20:50:10 -0500

> for me to whine, beg or jump through hoops.

Same here.  Also, the same goes for people who post questions on Usenet 
with broken reply-to addresses.  If I notice, I don't even start to 
answer the question for them.  (No, I am not going to edit an e-mail 
address by hand for the privilege of being allowed to e-mail you.)

> "falsely and fraudulently making or altering" SMTP headers.

Almost every piece of spam has at least one false Received: header, 
deliberately altering the correct path information to fraudulently 
suggest that the mail came from somewhere other than its actual origin. 
How is this even debatable?  If you don't believe it, sign up for 
SpamCop, and see what proportion of spam you report produces a "false 
Received: header" message in the traceback report.

mathew
-- 
<URL:http://www.pobox.com/~meta/>