Subject: [Asrg] Re: Asrg digest, Vol 1 #133 - 14 msgs

From: "Tony Preston" <[email-masked]>
Date: Thu, 27 Mar 2003 14:20:02 -0500

> From: Markus Stumpf <[email-masked]>
> To: "[email-masked]'" <[email-masked]>
> Subject: Re: [Asrg] My ideas...
> Organization: SpaceNet AG, Muenchen, Germany
>
> On Thu, Mar 27, 2003 at 11:04:36AM -0500, Preston, Tony wrote:
> > The problem has to be solved on the sending end or you do not have
> > a solution.  The only ideas that seem to make sense are the idea of
> > validating the sender at each hop (then as more and more MTAs get
> > updated to do this, the sender is better identified and can be
blocked)
> > and the idea of estamps.
>
>
> What exactly do you mean with "validating".
> We have some 1000 POP3/IMAP customers that use our mailservers also
for
> relaying.
> Should we disallow our customers to send emails with a different
> envelope sender than the one they have authenticated (SMTP AUTH) with?
> How about small companies that host their own mailserver?
>
What I mean is that if [email-masked] is the FROM user, he should exist
on example.com, a query to example.com would check to see if that is
true.

This would at least give you a user on a site that is responsible for
sending.  I realize
that a spammer just sets up the account joe.  What this does do is that
the first hop
from example.com will validate that there is the user joe and add the
validation header
to the email.   Each hop would ask the same question.

This is a lot of overhead in the email, it would happen on every email
on every hop.
The affect would be similar to the tarpit idea since it would hit the
guy doing the
sending with 10000 requests times the hops if he sends out 10000
emails...
Even if the headers are faked, you still know you got the email from the
current
connection, you can record it.  This gives you the ip address of the
spammer
and can be blocked.   If the validation fails, it would have to be
resolved before
the user joe could send email.

Sending email with a different envelope would have to be handled by
having a
validated FROM that will give the "THIS IS OK".   Sending with a fake
email
that will not validate gets the email bounced.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Chuq Von Rospach <[email-masked]>
Date: Thu, 27 Mar 2003 13:25:47 -0800

> on example.com, a query to example.com would check to see if that is

Minor semantical change (but important): [email-masked] should be 
AUTHORIZED to send email from example.com. You will have both addresses 
that exist to send e-mail but aren't users, and users that exist that 
shouldn't be sending email. If you just check for existance of the 
user, spammers can simply start sending all of their mail from, say, 
[email-masked], or [email-masked], or [email-masked], things that 
exist.

Better to be able to explicitly decouple user from permission, and set 
up a permission scheme that allows you to have users, but not send 
e-mail, to get away from forged role account issues.

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Mar 2003 13:03:20 +0100

> on example.com, a query to example.com would check to see if that is

There is such a identification method that was widelier used years ago.
It still exists and it's called IDENT (RFC 931) ... and it doesn't work.
It's all a matter of trust and you can't trust anybody or any system that
you haven't full control over.

I currently have in my queue the following emails (bounces) to
    [email-masked]
    [email-masked]
    [email-masked]
the emails spamvertise the website
    http://www.hotjuicycunt.com/

Where is the problem for the spammer to set up an identification/validation
service for  hotjuicycunt.com  and answer all questions with "yes".
Instead of a full featured system a 100 line program will do it for
spammers. Would it have stopped the spam? No.

> sending.

No it won't.
And there is always a user responsible, either the sysadmin for being a
loser or a spammer. And I doubt you will get a private home user
convicted for running an open proxy or being attacked by a virus that
installed an open proxy and being abused as spam relay.
So responsibility is not a spam breaker.

> spammer and can be blocked.

My database contains roughly 20 millions of those IP addresses and all
are blocked. I have no problems getting about 150000 new each day from
my logs. All I currently have to do is grep for
    HELO earthling.net
    HELO mail.worldnet.att.net
    HELO cyberproxy.com
and block the hosts identifying that way.

Also, the implication for every single person to be listed or for
mailinglists that use VERP are enormous. And, as I said before, those
systems can be attacked with dictionary queries that make it worse, more
than it will help.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: James Lick <[email-masked]>
Date: Fri, 28 Mar 2003 05:36:34 -0800 (PST)

On Fri, 28 Mar 2003, Markus Stumpf wrote:
> service for  hotjuicyspam.com  and answer all questions with "yes".

On the other hand, I could use such a facility to automatically say "no"
to any address verification for pleasure.com, a domain of mine which is
frequently forged and which I never use on outgoing email.  Bingo, no more
spam forged from that domain name.  If yahoo, hotmail and AOL deploy it,
you can no longer just randomly generate forged mail from that.

The problem such a facility solves is to make spam forgery more difficult,
and to force spammers into sending mail in a way that it can be tracked
back.  So my response to you is that your problem is actually a feature.
Whoever is running hotjuicyspam.com and merrily saying all addresses are
valid has just painted a huge bullseye target on himself making it easier
for me to reject his mail or take more extreme steps like suing him or
getting his connection yanked.

This system is akin to rejecting non-existant domains from sending mail.
Easily circumvented.  Standard practice for years.  Idiot spammers still
using fake domains like crazy.  Not nearly as much as before, but it still
blocks an awful lot of spam.

More serious aspects of such a system are that it may drive spammers to
forge spam from real addresses instead of fake, and that they may use such
facilities to do address verification or dictionary attack harvesting.

I would also like to say that I am disappointed in a lot of the criticisms
of spam blocking/prevention techniques.  A lot of people are rejecting
systems outright for having one or more flaws, when the system can still
be effective despite those flaws.  Rather, one should evaluate a system
not on whether it can be circumvented, but instead focus on the benefits
of making things more difficult for the spammers.  Even if it is just a
minor hassle to get around, it is still causing pain for the spammers.
Deploying many of these techniques in total means that eventually the
spammers are painted into a corner.

--- James Lick --- 黎建溥 --- [email-masked] --- http://drivel.com.tw/ ---
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Mar 2003 15:42:56 +0100

> The problem such a facility solves is to make spam forgery more difficult,

No, not really.
What is the probability to fake <name>@hotmail.com or <[email-masked]>
and get a hit? I'd say if you do it halfway intelligent it's about 98%.
So you get mail from
    [email-masked]
it gets verified by hotmail.com as existant.
What exactly help in this situation to eliminate spam?

> back.

I don't understand this.
    Mar 28 14:58:39 pid 38745: unknown:210.82.89.177 allowed:
	<[email-masked]> to <[email-masked]>
[email-masked] does not exist and never did. I haven't looked at the
message but I'd say with 99% probability that this was spam.

    220 YSmtp mta590.mail.yahoo.com ESMTP service ready
    RCPT TO: <[email-masked]>
    250 recipient <[email-masked]> ok

How exactly did the verification help in tracking back the message or
force them to send the message in a trackable form?

> So my response to you is that your problem is actually a feature.

1) what is wrong, if I accept all addresses @lamer.de to say that all
   addresses are valid? Why do I get a big bullseye target pointing on me?
2) If I don't want to accept emails from @hotjuicyspam.com I don't need
   any validation service as an argument. I simply don't do it.
3) If they use   susi<n>@hotjuicyspam.com  the way the number is used in
      owner-spamtools+<n>=maex-spamtools=[email-masked]
   and respond with yes for every [email-masked] what exactly
   makes the difference and helps you suing them - more than the reasons
   and arguments you already have now?

> blocks an awful lot of spam.

Yes. And now they fake existing domains.

> of making things more difficult for the spammers.

Forcing the spammers to use existing domain names by doing A and MX
lookups helped the situation for a short time. Now they fake real
addresses and things are worse than before, because the "system" was
too easy to circumvent.
I don't see the goal of this group to find a new method that works
for 2-6 months and after that it's worse than before.

> spammers are painted into a corner.

We already have many of these techniques and they are used. A lot of
them can easily be circumvented. What do they help? Does the spam volume
decline?
Having thousands of sysadmins plugin nitty gritty tools will not solve
the problem.

	\Maex

---

From: [email-masked]
Date: Fri, 28 Mar 2003 05:21:33 -0800 (PST)

Most (if not all) proposed verification methods and what they can and can 
not do are found in my presentation: 
http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf
(I still have not found time to put this into htm for website, sorry...)

---

From: James Lick <[email-masked]>
Date: Fri, 28 Mar 2003 08:30:42 -0800 (PST)

I'm probably not going to be able to convince you, but...

> them can easily be circumvented. What do they help? Does the spam volume

Each of the techniques now in use at one time was extremely effective.
Each of them still blocks spam in bucketfulls.  Together, current
techniques can still block 90% of spam.  Nothing at all that we do with
blocking will ever cause a decline in spam volume, and if anything, it
causes the spammers to increase their volume.  But ultimately that volume
goes up whether we try blocking it or not.  Are you suggesting we just
give up?

Most spam blocking techniques have the attribute that to circumvent it,
one either has to expose himself or resort to a more unethical/illegal
manner of sending the mail.  The fact that spammers more often than not
choose the unethical/illegal route is not a failing of the spam blocking
techniques, but a failure in the spammer's moral compass.  Such practices
only highlight the fact that spammers cannot be considered ethical.
Whatever we can do to push them to expose this should be encouraged.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 10:41:03 -0500

>forge spam from real addresses instead of fake, and that they may use such

The good news there is that if they do that, the legal hit is 
considerably higher.

I think most people have agreed on this list that address 
verification would be useful in preventing fake addresses.  It 
wouldn't stop spam, but it would help stuff the spammers into a 
smaller box.

What doesn't seem to have any agreement is *how* to do address verification.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 28 Mar 2003 06:45:36 -0500

> and to force spammers into sending mail in a way that it can be tracked

  I agree whole-heartedly.  An 'ident' style requirement will never
solve all of the spam problem, but it may help.

> getting his connection yanked.

  The owner of the domain name has also lost plausibile deniability.

  When email "from" some domain comes from a random IP which is not
verifiable to be associated with that domain, then we can have:

 - the domain owner claiming the mail was forged, so he's not
   responsible for
 - the owner of the IP claiming the IP was sub-let to someone else
 - the sub-letter claiming the box was "hacked", and he's not
   responsible, either.

  Having a domain publicly admit to be associated with an email makes
the work of assigning responsibility that much simpler.

> minor hassle to get around, it is still causing pain for the spammers.

  If the hassle to non-spammer is worse than the hassle to spammers,
then the "solution" has problems.

  But in general, I agree that we will need multiple imperfect, but
over-lapping solutions.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 28 Mar 2003 07:00:09 -0500

> What exactly help in this situation to eliminate spam?

  When coupled with a system like RMX, the effectiveness of an 'ident'
increases substantially.  Messages can be shown (with some confidence)
to be legitimately from a domain.

  Together, these two techniques ensure that spammers are either
traceable, or more likely to be easily determined to be spammers.

> for 2-6 months and after that it's worse than before.

  None of these solutions are proposed in isolation.  Can we please
STOP assuming that any solution will be the ONLY one implemented, and
attacking it based it's imperfections when used in isolation?

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 12:17:03 -0500

>What exactly help in this situation to eliminate spam?

1. It makes it more obvious to the clueless that spam is not 
legitimate.  Sending email with a fake address is very different from 
sending email using someone's real address.
2. It gives us a better legal hammer with which to hit spammers. 
Damages are more clear (some of the early spam suits were of this 
type), and a number of existing laws come into play as soon as you 
send something while pretending to be someone else.

Nobody is claiming this will stop spam.  However it will limit a 
certain type of abuse which is now extremely common.

In addition, such a mechanism has the potential to be used to verify 
that addresses entered on a web form are valid *before* they are sent 
email.  I'm sure I'm not the only one running a domain that would 
greatly benefit from that check.

>Yes. And now they fake existing domains.

Right.  We've limited their return address options.  Add the ability 
to check addresses and we limit them more.  This seems like a move in 
the correct direction.

>Having thousands of sysadmins plugin nitty gritty tools will not solve

Agreed.  But the alternative is replacing them all with a new system. 
And that's not going to happen.  So we work with what we have.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Mar 2003 19:50:52 +0100

> wouldn't stop spam, but it would help stuff the spammers into a 

It wouldn't even reduce the amount of spam.
Is it just me or why do I get the impression that a lot of people think
that spammers are dumb idiots and that telling them "nanana, you can't
do this anymore" will change a thing?
I am rather sure they are on this list and watch closely to be prepared
and they are no idiots.

Has anybody noticed spam like e.g. (addresses are envelope information):

unknown:66.118.181.5 HELO gfpqkw.com
unknown:66.118.181.5 rejected: <[email-masked]> to <[email-masked]>
unknown:66.118.181.5 rejected: <[email-masked]> to <[email-masked]>
unknown:66.118.181.5 rejected: <[email-masked]> to <[email-masked]>

What's so unusual about it?
It's not a  1:n  relation, but a  n:1  relation in one connection from
the same host. Spammers no longer depend on the multi RCPT_TO feature
and it still works.
It shouldn't be too big a problem to combine pairs from their databases
(just like a lot of outlook viruses already do from the addressbook)
and use the same ole algorithms.
Or let the software abuse the domain of the abused mailserver (ok, that's at
least more fair than using the domain of anyone unrelated).
The changes to the existing software should be minimal, I'd assume.

The spammers software is evolving and the time when it was "dumb"
is long gone.

I have skimmed over Williams slides at
   http://www.elan.net/~william/asrg-emailpathverification-presentation.pdf
and what I am really missing in the scenarios are e.g. the thousands of
small companies on a dynamic DSL connection that depend on running their
own mailserver, because they are connected to "ISPs" that don't offer
this service. Have you ever asked them what they think about DUL?
What will they think about validating services or RMX? From my
experience 80% won't even understand what you are talking about.

I really don't know ... does hotmail, yahoo etc all provide SMTP
relay services or do you have to use their web interfaces?
If they don't provide SMTP relay there is also missing a solution for
the thousands of public mail service provider users that use those
addresses for this and that, from Internet cafes or from their
mailbox.

We need a rather easy and widely adoptable solution or it won't work.

And really I don't want to "attack" all the discussed solutions, but if any
such system should be a workable approach, using a "all or nothing" system
if probably the worst. Also a solution that needs a "if you support system
X it's nice, if you don't I'll take it too" is rather absurd.

When designing such a system
- think about universities ... will they set up validation mechanisms
  for ten thousands of users?
- think about medium sized companies ... will they change to the new
  system?

The more we burden the end user (and in this area small/medium companies
qualify as end user) the system will fail, because they won't go through
the hassle. And if they don't do it nobody will. As an ISP I can't change
to a system on 1.1.2004 that is used by 5% of all users and tell my
customers "too bad. And no it won't stop spam but it makes it harder,
and sorry that you cannot talk to your clients any more". And if there
are reasons ISPs can't (easily) migrate, they won't at all.

IMHO an integral part of all those discussions should be

- benefit
	how much spam will it stop MORE
- costs
	how much will it cost to install and maintain the system
	What is the cost of adding one new user to the system.
	(think small companies .. hiring a technician and paying big
	bucks for adding an email account will distract them).
- usability
	how much has every user to do more to send email to another
	person? How complicated is it? Will they want to do it?
	Do they need new software?
- transition
	are there pitfalls during a transition period? Will hosts
	that have [not] changed be isolated? How much percent of email
	users in total will take part right at the start at a specified
	date. what is the estimated period that we expect users to switch
	to the system.

Besides I am not too convinced behind the ideas of all systems discussed,
most badly fail at least 2 of the above topics.
And no, I don't have a resourceful solution. If I had I wouldn't discuss
here but wade in money.

	\Maex

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Mar 2003 20:33:23 +0100

> I'm probably not going to be able to convince you, but...

:-))

> goes up whether we try blocking it or not.  Are you suggesting we just

No. What I'd like to have is a situation like with a desease (e.g. influenza).
You can use some medicine to ease headache and another to ease cough,
i.e. cure the symptoms.
Or you can fight the virus causing all the problems at the root.

> Whatever we can do to push them to expose this should be encouraged.

Do you think there is one person on the Internet that uses email for
longer than 3 month that is not aware of this? But
- others do it and they don't go to jail, so why shouldn't I do it
  I suffer from them so they can also suffer a bit because of me.
- ethics are fine, but if your company is bankrupt, because you are
  ethical and the unethical guy next door earns millions of dollars,
  how would you decide? How will 90% of the world population decide?
  And remember, it's sad, but spam really works :(
So just pushing someone in the unethical corner won't help :-((

And: if a spammer is forced to use your email address to send out the crap
because using totally faked ones is impossible, because we wanted him to
expose that he is unethical, you'll wish he wasn't pushed that hard.

I can sue him then, you'll want to argue, right?
We're located in Germany. Our domain was abused. About 5 million bounces.
A few hundred complaints that our abuse Team had to deal with.
The spam was injected via dialup accounts in Mexico, Brasil and Argentina.
The contact address is
    Power Publishing, P.O. Box 7138, North Port, FL 34287
What do you think the chances of any successful legal action are like?
IANAL, but I'd say zero.
There is no evidence that the above company is the originator of the
spam. They could argue some competitor did it to mischief them. Case
closed.

	\Maex

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Mar 2003 20:37:43 +0100

> attacking it based it's imperfections when used in isolation?

The more different solutions you will need to work together "to make it
work" the lower are the chances any of these will be adopted, because
the migration pathes will be too complicated or even not working at all.

	\Maex

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 16:37:43 -0500

>expose that he is unethical, you'll wish he wasn't pushed that hard.

The interesting thing from a historical perspective is that forging 
real email addresses and the domains of third-party companies is far 
*less* common that it used to be.  The major ISPs still get a lot of 
it, but the days when it was some random company (or somewhere.com) 
seem to have stopped.

Would they come back if we forced authentication?  Maybe.  But 
authentication solves a lot of other problems as well.  Overall it 
sounds like a win if we can come up with a scaleable plan.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 16:34:32 -0500

>It wouldn't even reduce the amount of spam.

So? I repeat.  "It would help stuff the spammers into a smaller box." 
Smaller box.  Easier target for blocking.

>do this anymore" will change a thing?

That is not my impression of this list.

>I am rather sure they are on this list and watch closely to be prepared

Yep.

>and use the same ole algorithms.

Yep. Already being done to some extent.  One reason why 
from-whitelisting is a short term solution.

>own mailserver, because they are connected to "ISPs" that don't offer

That's a flaw with IP-based solutions.  As I said.  The concept has 
support, the disagreement is with the implementation.

>   for ten thousands of users?

They already do.  Bad addresses bounce.  That's not because the 
accounts are delivered by the outside mail server.  It's because the 
told the outside mail server what accounts were.

But you are missing the main advantage of sender validation.  It's 
not an advantage that helps fight spam immediately.  But it *is* one 
that helps it get deployed.

You don't have to deploy it if you don't care about people forging 
your domain.  In other words--the cost of deployment is laid at the 
feet of the people who care most.

>are reasons ISPs can't (easily) migrate, they won't at all.

I agree 100% with your deployment arguments.  The majority of my 
messages to this list have been against systems with ridiculous 
deployment plans.  I just don't understand what you consider cost. 
You are complaining about sender validation.  Of all the proposals 
people have made here, it's one of the ones that has the *smallest* 
cost.  If you don't think that's doable, what exactly do you consider 
manageable?

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 16:25:25 -0500

>the migration pathes will be too complicated or even not working at all.

You're assuming that everybody has to install N solutions.

It appears that the direction we are heading is: Everybody may 
install one instance of N different solution types.

As to whether this will be adopted over replacing the system with 
something entirely new, I think the market has already spoken. 
Content filtering.  DNSBLs.  Custom blocking.  Spam Traps.

The market already *is* installing lots of migration patches. 
Because incremental changes, no matter how horrible from an 
architectural standpoint, are easier and safer (from a sysadmin 
standpoint) than wholesale change.  This is especially true when 
there are competing solutions.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 28 Mar 2003 15:28:15 -0500

> the migration pathes will be too complicated or even not working at all.

  I understand.  But we keep looking for magic solutions, we'll never
get anywhere.

  Any solution, or set thereof, which can be demonstrated to work and
to be less costly than current solutions will quickly gain wide-spread
adoption.

  Alan DeKok.

---

From: "Tim Kehres" <[email-masked]>
Date: Sat, 29 Mar 2003 09:41:22 +0800

> the migration pathes will be too complicated or even not working at all.

I don't think this is necessarily the case.  In fact, I don't personally
believe that there is a single one solution that we can apply that will
solve the entire problem.   For instance, there are things you can do at
SMTP connection time (reverse DNS validation, sender/recipient checks, and
others that have been mentioned here).   These types of checks simply are
not practical after receipt.   On the other hand, detailed header analysis,
content analysis and filtering and such for most systems is not practical to
perform during the SMTP session for performance reasons.

I believe we have a farily complex problem here to solve.   As with most
such systems, breaking it down into smaller, more managible components, can
often lead to a quicker and better solutions.  And there is nothing to say
that further down the road many of these smaller solutions can't be combined
once the problems and their resolution are better understood.

Best Regards,

-- Tim

---

From: [email-masked]
Date: Sat, 29 Mar 2003 00:34:42 -0500

On Fri, Mar 28, 2003 at 05:36:34AM -0800, James Lick wrote

> On the other hand, I could use such a facility to automatically say
> "no" to any address verification for pleasure.com, a domain of mine
> which is frequently forged and which I never use on outgoing email.
> Bingo, no more spam forged from that domain name.  If yahoo, hotmail
> and AOL deploy it, you can no longer just randomly generate forged
> mail from that.

  To which, my response was going to be...

> More serious aspects of such a system are that it may drive spammers
> to forge spam from real addresses instead of fake, and that they
> may use such facilities to do address verification or dictionary
> attack harvesting.

..bingo.

> I would also like to say that I am disappointed in a lot of the
> criticisms of spam blocking/prevention techniques.  A lot of people
> are rejecting systems outright for having one or more flaws, when
> the system can still be effective despite those flaws.  Rather,
> one should evaluate a system not on whether it can be circumvented,
> but instead focus on the benefits of making things more difficult
> for the spammers.  Even if it is just a minor hassle to get around,
> it is still causing pain for the spammers.

  Spammers *WILL* adapt.  Spammers may have started off as primitive
pond scum, but today they're highly evolved pond scum.  If a system can
be trivially circumvented, it *WILL* be circumvented.  Here's where I
disagree with you.  You are evaluating a sample of spam in your inbox,
and asking "How much will be blocked if I implement rule X?".  I feel
that you should also ask "How easy is it to circumvent without the
consequence of reduced delivery of spam?".  The blocking of anonymizing
relays can be "circumvented" by not using them, but other avenues of
delivery aren't as "good" from the spammer's viewpoint.  Forging an
existing address instead of a non-existing address is relatively easy.

-- 
Walter Dnes <[email-masked]>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg