Subject: RE: [Asrg] This research group will fail

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 19 Mar 2003 11:09:48 -0800

> Spam is a business with growing revenue. The small business
> is sending spam. The big business is selling anti-spam-solutions.
> Obviously those, who's business is either one of these, try to prevent
> a simple and effective solution. 

So every fireman is an arsonist and every policeman a theif.

A ubiquitous and pervasive authentication mechanism has value even if there
is no more spam.

Spam provides a means to get to critical mass, once a critical mass is
established it will have value in its own right.

	Phill 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 19 Mar 2003 15:01:20 -0500 (EST)

From: Hadmut Danisch <[email-masked]>

> I wouldn't be surprised at all if most of the spammers turned out
> to be the same people selling anti-spam-software and services, and
> trying to put through recipient-only solutions.

Full-disclosure: I make a living selling anti-spam software.

Nevertheless, I am not a spammer.  I also give away the core of my
product for free under the GPL.  And I offer for free anti-spam ideas
that anyone (including my competitors) can use or not as they see fit---
I don't go for dumb patents or stupid trade secret protection.

The bottom line is that I also think this research group will fail,
if by "fail" you mean "find an effective standard solution that stops
almost all spam, and is implementable within the next decade."

I think my business model is realistic:  I don't expect a real
solution to spam without massive reworking of Internet protocols, and
I don't expect that reworking to take place in under a decade.  In the
meantime, I see an opportunity.

If you do not like my business model, don't buy my products, or else
just use the GPL'd subset.

--
David.

---

From: [email-masked]
Date: Thu, 20 Mar 2003 10:30:23 +0800

>A ubiquitous and pervasive authentication mechanism has value even if 
there

.....and in most places it still doesn't work. ( ask the French 
Gendarmerie where ID cards are mandatory )

And when it doesn't exist the Police are not rendered ineffective ( ask 
the Police in the U.K. where ID cards are not used at all )

Any authentication mechanism has holes - check out the problems with DNA 
identification. (... and yes I do know the difference between 
authentication and identification. I just happen to believe that the 
nomral 1:1 between legitimate email users and their addresses blurs the 
distinction here )

Yes, there are processes where proving your identity to the satisfaction 
of "the authorities" is mandatory e.g. drivers licence, gun licence etc. 
etc.

But none of these has the ubiquity, utility or pervasiveness of email and 
so will never hit the issues of scaling that trying to enforce strong 
authentication on email users would meet.

I believe spam is a social evil and requires a social cure. There are not 
Technical answers to all problems. Spam is a case in point.

OK, we may be able to do Technical things which can help in the short 
term, but in the long term figuring out a way to get legislators in a 
global context to harmonise the legal context for misuse of public 
Services is likely to be the only solution.

And adapting "junk mail" laws probably won't cut it - extradited for 
sending unsolicited leaflets?

Anyone remember E. E. Smith? The context here is very similar to the 
reasons given in "Triplanetary" - but watch out! We could end up with 
Judge Dredd instead of the Lensmen.....   ;-)

Regards,

tom.
__________________________________________________
Security Consultant/Analyst
CSC
Ph: +61 8 9429 6478    Email: [email-masked]
----------------------------------------------------------------------------------------
This email, including any attachments, is intended only for use by the 
addressee(s) and may contain confidential and/or personal information and 
may also be the subject of legal privilege. Any personal information 
contained in this email is not to be used or disclosed for any purpose 
other than the purpose for which you have received it. If you are not the 
intended recipient, you must not disclose or use the information contained 
in it. In this case, please let me know by return email, delete the 
message permanently from your system and destroy any copies.
----------------------------------------------------------------------------------------

Sent by:        [email-masked]
To:     Hadmut Danisch <[email-masked]>, [email-masked]
cc: 
Subject:        RE: [Asrg] This research group will fail

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 19 Mar 2003 21:19:29 -0800

> the Police in the U.K. where ID cards are not used at all )

UK law requires every business to list on its letterhead its
registered office at which service can be effected.

> Technical answers to all problems. Spam is a case in point.

It is a purely technical problem, the email infrastructure
was designed to be used by a small number of people most of
whom were highly expert and almost none of whom would attack 
the network.

Today the network is vast, approaching a billion users. Almost
all of whom are clueless technically and a very large number
of whom are malicious if not outright evil.

You go off and try solving the social problems if you like.
I believe you will find that they are far less tractable than 
technical approaches that face the reality of the social 
constraints.

I don't care whether you are a slave to a right wing ideology
like the sender pays people for whom a market is the solution 
to every ill or a slave to a left wing ideology like the
anti-corporativists for whom the problem is always a corporate
interest and the solution always to eliminate the corporations.
If you are a slave to an ideology you become an idiot.

		Phill

---

From: [email-masked]
Date: Thu, 20 Mar 2003 14:10:30 +0800

>registered office at which service can be effected.

But ( and you'll correct me if I'm wrong ) not all spammers are 
businesses, and even when they are, setting up a business for the Xmas 
season and closing it in January is still legal. Where's your process 
server when the goods fall apart in two months, despite Consumer 
Protection laws?

>If you are a slave to an ideology you become an idiot.

Mate, I couldn't agree more.

I still get this feeling that altering the behaviour of spammers in the 
long term won't happen by changing the RFCs, however much I'm willing to 
try it because I have to hope it is possible to improve on what we have.

But I'd be willing to bet my $.02 that "judging intent" of email whether 
by content or "authorised source" will turn out to be beyond a Computer, 
particularly without mucking things up for the billion clueless users who 
WANT to send anything anywhere quickly.

On with the show!

Regards,

tom.

---

From: "M Wild" <[email-masked]>
Date: Thu, 20 Mar 2003 10:15:46 -0500

This proposition really depends on how you define fail.  If you mean the
solution does not eliminate *ALL* spam I'd say I have to agree.  However my
requirement is not a 100% solution...I just want some relief, for my users,
for my servers and for me.  A number of list members have mentioned that it
appears folks are looking for the "magic bullet"  There is not one so
looking for it is a waste of time.  I suspect that there will be a number of
different measures that solve small parts of the problem and when combined
make a real difference.  My ideal solution is something that takes place
during the SMTP handshake...if the mail gets to the DATA phase then my mail
server is committed to doing the work of virus scanning the mail, marching
it around the various queues and either delivering it to the user's mailbox
or having to bounce it back to the (probably fictitious) sender.  That is a
loss for me.  I have philosophical issues with whitelists/blacklists mainly
due to the fact that I don't want my mail servers to have to keep track of a
lot of stuff and/or turn over control of who I will/will not accept mail
from to an external party.  I may have to get over this in order to get to a
solution that works.  If I really thought this group was going to fail this
would be an unsubscribe...the mail volume on this list is, well,
significant.  I'm still here because I'm convinced the collective wisdom of
the list will come up with *SOMETHING*  If nothing else the humor of some of
the posters gives me a chuckle on a regular basis and that is definitely
worth reading.

Regards
Mike