Subject: RE: [Asrg] Re: Asrg digest, Vol 1 #133 - 14 msgs

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 28 Mar 2003 12:01:44 -0800

> It wouldn't even reduce the amount of spam.
> Is it just me or why do I get the impression that a lot of 
> people think
> that spammers are dumb idiots and that telling them "nanana, you can't
> do this anymore" will change a thing?

Lightweight authentication by IP address will reduce the amount
of spam in the short term. In most part the same way that car
alarms reduce the chance that YOUR car is the one stolen.

> I am rather sure they are on this list and watch closely to 
> be prepared
> and they are no idiots.

Some are idiots, quite a lot in fact and yes it would be 
rather good if those millions of CDROMs with email addresses
on started to become useless.

> It shouldn't be too big a problem to combine pairs from their 
> databases
> (just like a lot of outlook viruses already do from the addressbook)
> and use the same ole algorithms.

That is whay any authentication mechanism has to be set up
so that it can progress from lightweight authentication on
the sender IP address to more robust, cryptographic means.

Eventually we are going to have to deploy DNSSEC or SSL mail
certificates to defeat the bastards but we don't need to do 
that on day one to reduce the problem. 

> Have you ever asked them what they think about DUL?
> What will they think about validating services or RMX? From my
> experience 80% won't even understand what you are talking about.

Clearly the distinction between Dial up lists ceases to have
any utility once everyone is using DSL. Plenty of companies are
legitimately using DSL to support mail servers. DSL has plenty
of capacity for that task - heck not so long ago the whole of CERN
had less bandwidth than my cable provider gives me for my house.

There is an important point here, what appears to be expensive
to geekdom can be cheap to businesses, what appears cheap can
be very very expensive. In particular IETF solutions tend to
view geek time as being free. There is perhaps even a conflict
of interest here since many of the people who press for geek
intensive solutions then go out to sell expensive consulting
services. 

So proposing that someone use SSL and get a CA issued certificate
for $350 is a no-no, but devising an obfusticated and complex 
protocol that requires many days of $2000/day consultancy is OK.

Err... right.

> I really don't know ... does hotmail, yahoo etc all provide SMTP
> relay services or do you have to use their web interfaces?
> If they don't provide SMTP relay there is also missing a solution for
> the thousands of public mail service provider users that use those
> addresses for this and that, from Internet cafes or from their
> mailbox.

The only mechanisms I can think of that is currently deployable
for that application would be to either relay email through a
hotmail SMTP relay (with appropriate authentication of course),
or to issue the users with S/MIME certificates, probably as
part of a 'premium account' package.

Of course the volumes of the certificates involved would probably
make the cost per cert pretty minor.

[In cae you are wondering why I don't suggest PGP, well first,
Hotmail and AOL are both parts of companies that produce S/MIME
products so it is very unlikely they would support a competing
spec, second the authentication model of PGP is not at all easy to
automate for the customers who use Hotmail, Yahoo, Earthlink and 
AOL.]

> We need a rather easy and widely adoptable solution or it won't work.

Amen.

> Also a solution that needs a "if you 
> support system
> X it's nice, if you don't I'll take it too" is rather absurd.

What is needed is a way for Hotmail to say 'we support system X,
everything else should be rejected'.

			Phill 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steven F Siirila <[email-masked]>
Date: Fri, 28 Mar 2003 14:11:20 -0600

> had less bandwidth than my cable provider gives me for my house.

We block IP address ranges which are used for dialup/dynamic addresses.
As far as we're concerned, if you don't have a static address for which
we can reach you at Postmaster@[IPaddress] later on, you have no business
sending us email from that address.  Such users are told to route their
email through their ISP or obtain a static IP address for their MTA.
-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: [email-masked]
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 28 Mar 2003 21:18:14 +0100

> email through their ISP or obtain a static IP address for their MTA.

If the DSL provider charges extra bucks for use of their mailserver or
doesn't have a mailserver at all and the client of a customer of yours
(we're an ISP) tells your customer "manage to receive my email or I'll
cancel the contract" what would you tell your customer?
How many of your own customers can you afford to loose because of that?

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steven F Siirila <[email-masked]>
Date: Fri, 28 Mar 2003 14:23:49 -0600

> How many of your own customers can you afford to loose because of that?

How many customers can we afford to lose if we continue to allow the huge
amounts of spam that were coming in via dialups?  ;-)  As always, tradeoffs.
Actually, we've had little to no complaints.  Our user base is about 100,000.
--

---

From: [email-masked]
Date: Sat, 29 Mar 2003 02:06:45 -0500

On Fri, Mar 28, 2003 at 12:01:44PM -0800, Hallam-Baker, Phillip wrote

> had less bandwidth than my cable provider gives me for my house.

  You're missing the whole point.  It's *NOT* a question of whether the
underlying technology is DSL/Cable/two-cans-connected-with-copper-wire.
The important point is *STATIC* versus *DYNAMIC* IP addresses, and the
accountability issue.  If somebody spams from a static IP address, I can
block the address, and not have to block anybody else.  If the spam
comes from a "cloud" of addresses, and is different every day, I have to
block the entire cloud.  If a business can't get *ONE* static IP address
I really have to question their competence.

> everything else should be rejected'.

..without losing 90% of their customers when they find out that the
rest of the planet doesn't talk "HMTP" (Hotmail Mail Transfer Protocol).
AOL or MSN *MIGHT* get away with this, because...
  a) they're big enough
  b) unlike Yahoo, they have their own internal content.  I'm sure that
     AOL would *LOVE* to go back to the days of their "walled garden".

-- 
Walter Dnes <[email-masked]>
An infinite number of monkeys pounding away on keyboards will
eventually produce a report showing that Windows is more secure,
and has a lower TCO, than linux.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steven F Siirila <[email-masked]>
Date: Sat, 29 Mar 2003 09:55:36 -0600

> I really have to question their competence.

Precisely.  I know many people around here who have DSL with static IP address
blocks and their own domain name and reverse DNS.  This is residential.
I cannot imagine why, then, a legitimate business/organization would have to
resort to running an MTA on dynamic IP addresses.

Again, this is really a matter of what works for an organization.  And for
ours, this is just one of many effective "tools" for fighting the onslaught
of spam.

--

---

From: Jim Youll <[email-masked]>
Date: Sat, 29 Mar 2003 11:21:07 -0500

>ours, this is just one of many effective "tools" for fighting the onslaught

Just because some can have it, does not mean that all can have it.
Legitimate businesses/organizations come in many sizes with varied ability
to handle much of anything. If they can only have PPPOE, for example, then
what happens with IP and DNS is anybody's guess.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Sat, 29 Mar 2003 22:15:23 -0500

On Fri, Mar 28, 2003 at 09:18:14PM +0100, Markus Stumpf wrote

> If the DSL provider charges extra bucks for use of their mailserver

..and the customer is a cheap bastard ?

> or doesn't have a mailserver at all and the client of a customer
> of yours (we're an ISP) tells your customer "manage to receive my
> email or I'll cancel the contract" what would you tell your customer?

  The concept of an alleged "ISP" that provides neither a mailserver nor
a static IP address boggles the mind.  If you were the only "ISP" in
town, your customer would have to purchase service from another provider
elsewhere who would allow them to either ssh-tunnel or smtp-auth to
their mail server.

> How many of your own customers can you afford to loose because of that?

  How about providing your customers with the service they need ?  That
tends to keep customers loyal.

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 31 Mar 2003 14:38:06 +0200

> ..and the customer is a cheap bastard ?

No, not necessarily, but with the "hype" of the last few years and
everybody telling people "Internet is cheap" or "Internet is free"
customers don't get the point that if they pay 50 bucks for a flat
connection why they should pay additonal 15 bucks for using a
mailserver. But managing a line and a router is cheap compared to
running a mailserver that handles about 0.1% of the same traffic.

> elsewhere who would allow them to either ssh-tunnel or smtp-auth to

Subcontractors is the answer.
Buy a contingent of 10000 DSL lines from your Telco (and in Germany there
are *lots* of towns, where you have no choice, which Carrier to use) and
arrange a special prize.
Sell it with a marginal earning and no service at all. All you provide
is the contract. Customers will like it, because it is so cheap. And a lot
will use hotmail, yahoo and others for email. As the carrier disconnects
the line once within 24 hours, they can't have a "static" IP address.
Whether you call this an ISP not not is a matter of definition, but most
would probably call it an ISP.
Now, if you want to have our own outgoing mailserver on such a line
you have to deliver directly as your "provider" doesn't have a smarthost.
If the IP block is on a DUL DNSBL you're lost.

> tends to keep customers loyal.

We do.
But if a company is connected via an above described "ISP" and you block
their emails to your customer, because of the DUL DNSBL and they tell your
customers they will terminate the contract with him, if they can't
reach him via email you have two choices:
a) keep the DNSBL and loose your customer
b) turn off the DNSBL and keep the customer

How many of your own (and especially bigger) customers can you afford to
loose because a) these times?

	\Maex