Subject: Re: [Asrg] filtering at connect time

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 10:32:04 -0500

>Keith Moore <[email-masked]> wrote
>arrrgh.
>
>we used to run an "open relay".  we had measures in place to keep it
>from being used by spammers, and they worked.  but it would pass the
>blacklisters' tests for open relays, so we got blacklisted.  and people
>started to refuse mail from us.

Could you elaborate a bit about the measures you used to prevent is use
by spammers?

I'm not sure why open relays are useful now... don't all networks/ISPs
have local SMTP servers these days?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Michael Marking <[email-masked]>
Date: Wed, 5 Mar 2003 07:58:26 -0800 (PST)

> have local SMTP servers these days?

Some ISPs restrict use of their servers to those who have dialed in
from the ISP's own networks. Therefore, if you are a customer of ISP
X travelling away from home, you may not have access to that ISP's
SMTP servers. Even if you make arrangements to use a different ISP
while travelling, you may find when you arrive that the system doesn't
work (which can be very frustrating if you don't speak the language of
the country you are visiting).

Also, some people have no ISPs, but gain access by being a guest on
someone else's network. For various reasons, they may not want to
use that person's network to send mail. (For instance, they may not
want anyone to know they are visiting a certain person, while they
are using that person's network.)

Finally, open relays provide some measure of anonymity for the sender.

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 11:00:56 -0500

>the country you are visiting).

POP-before-smtp solves this quite well, stands up to analysis.

if not, use AT&T or whatever it's called. They have POPs in every country, and
support pages in every language. This is not a particularly 
compelling argument.

>are using that person's network.)

Source IP is still on there even with the most sloppy remailers these days.

>Finally, open relays provide some measure of anonymity for the sender.

Not compelling at all. If the relay is at all responsible, the source IP is
on there just the same. If the sender is a member of a large ISP (e.g.  even a
cable modem user) then the message is pooled with millions... no anonymity
benefit whatever.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Michael Marking <[email-masked]>
Date: Wed, 5 Mar 2003 08:40:59 -0800 (PST)

> support pages in every language. This is not a particularly

Not everyone has such a choice of internet providers. There are
still some places in the world with telco monopolies, and even
here in the US there are rural areas without many choices. And
why should I be required to use XYZ provider so I can get access
in one other country for a short vacation every year?

I know people who use those $9-a-month internet services quite
happily, but who might occasionally travel to places where they
are not available. Why should they pay twice as much for the
privilege of using a mail relay a few times a year?

> Source IP is still on there even with the most sloppy remailers these days.

Not all applications require cryptographic levels of anonymity.
Maybe I just don't want to make it obvious to Customer X that
I am on good enough terms with Customer Y to use the latter's
SMTP server. (Perhaps Customer Y won't let me, anyway.)

> cable modem user) then the message is pooled with millions... no anonymity

There is a difference between the mail header saying the message
came from CustomerX.com and the mail header saying the message
came from IP address 192.168.1.1, especially if the IP address is
from a pool of dynamically assigned addresses. The level of
privacy required for some purposes is different from that required
for other purposes.

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 12:24:11 -0500

>in one other country for a short vacation every year?

I think if you were able to make arrangements for internet access,
you must be conversant enough to read the config page and use the
local SMTP server.

>privilege of using a mail relay a few times a year?

pop before smpt, no worries

>SMTP server. (Perhaps Customer Y won't let me, anyway.)

If you're trying to hide that kind of info, either get a VPN or a 
wireless client.
That's an absurd justification for random open relays.

... not to mention that absent policy information, there's no way to 
demonstrate
that an open relay is actually intended for your use at all...

>privacy required for some purposes is different from that required

You are totally missing the point that there is nothing added by
embedding an open SMTP server in the middle of this process.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Templeton <[email-masked]>
Date: Wed, 5 Mar 2003 11:04:00 -0800

On Wed, Mar 05, 2003 at 07:58:26AM -0800, Michael Marking wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 

Worse, thanks to the efforts of us (well, the anti-spam community)
there are now ISPs that don't allow you to use their outgoing SMTP
server with an e-mail address that is not in their domain.  Pain
in the butt, and a great example of something that does more damage
to the utility of the open e-mail system than it does to stop spam.

I don't know if they have combined port 25 block/redirect with
"force you to use our domain" but that's coming next I fear.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Michael Marking <[email-masked]>
Date: Wed, 5 Mar 2003 11:18:14 -0800 (PST)

> embedding an open SMTP server in the middle of this process.

No, that is not what is going on. I gave some reasons to keep open
relays (and no doubt others could give more), and you simply valued your
approach more than the ones I suggested.

Our charter (http://www.irtf.org/charters/asrg.html) is "to understand
the problem and collectively propose and evaluate solutions to the
problem". This includes evaluations of "the usefulness and cost of
proposed solutions."

It is certainly premature to assume that the net cost of one solution
(such as eliminating open relays) exceeds or trails the net cost of
another solution (such as content filtering). This is especially true in
that one user's individual situation may differ greatly from that of
others' situations. If there is not an extremely good and compelling
reason to impose the values of the majority on everyone, then it is both
unethical, and poor engineering, to do so.

You appear to assume that, since open relays are not "necessary", then
they have no value, however slight. There are two flaws in this
argument:

	First, you arrogantly dismiss the cost to others of your
	solution. Simply because I have access to resources does not
	give me any moral right to require everyone else to acquire
	those same capabilities. If you were willing to go out at your
	own expense and personally reconfigure all of those open relays,
	then perhaps I would be convinced there is no cost to anyone
	(except you).

	Second, there may be no benefit whatsoever to requiring closure
	of all open relays. Even if all open relays were closed, then
	the spam problem would not be solved. If (when) we determine
	that some other solution would be effective and cost little,
	then why close the relays?

Therfore, you cannot rightly say that "there is nothing added by
embedding an open SMTP server in the middle of this process". You may be
(and I believe probably are) wrong regarding both the cost and benefits.

Until we can quantify, or at least describe, the benefits of all
reasonable solutions, it is inappropriate to rule one out merely because
an alternative does the same thing.

---

From: Jim Youll <[email-masked]>
Date: Wed, 5 Mar 2003 17:13:28 -0500

>approach more than the ones I suggested.

I don't see much use for a wide open mail relay, generally, considering
the magnitude of the problem that is caused.

With the existence of blacklists and so on, wide open relays are not 
a workable solution anyway.
I would liken a wide open relay to an attractive nuisance, in legal 
terms. It's there, people use it *very* badly (to such an extent that 
it even draws toward itself others who use it badly).

>unethical, and poor engineering, to do so.

A wealth of alternatives exist that do not bear the detrimental 
effects of wide open mail relays.
>	then perhaps I would be convinced there is no cost to anyone

The number of open relays appears to have declined quite a lot from 
the time I started working on the spam problem generally. It is 
simply not and never has been in an arbitrary relay operator's 
interest to allow the use of his resources by others... that's a 
very, very simple economic argument.

If you are trying to advance a theory that the cost of one-time fixes 
to unnecessarily open relays is anything significantly more than the 
ordinary cost of mail server maintenance, I definitely won't buy into 
it.

>	then why close the relays?

Open relays are historically a tremendous source of spam, because 
they hopelessly complicate the matter of assigning responsibility, 
and because there is no administrative recourse for the actions of an 
unaffiliated third party carried out through such an unsupervised 
system. I don't think there's any model quite like the "open relay" 
anywhere else on the net or in real life for that matter. If you are 
running a "somewhat open" relay that knows its own users as they move 
about, that is a very different matter.. there is administrative 
oversight, recourse, responsibility...

>(and I believe probably are) wrong regarding both the cost and benefits.

You were alleging that open relays somehow promote privacy. An open 
relay does nothing to improve a sender's "privacy". Services such as 
hotmail or an AOL screen name do much more for privacy than a open 
SMTP relay every could.

>an alternative does the same thing.

But when the argument on its face does not support the alleged 
benefit, i feel obligated to point it out.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg