Subject: [Asrg] Time for the ISPs to fight back!

From: "Richard" <[email-masked]>
Date: Wed, 5 Mar 2003 19:52:51 -0000

I believe that it is not enough to just keep developing ever more complex methods of filtering out spam, the spammers will just continue to circumvent the filters. Witness the recent use of spacing between letters such as "L_O_OS_E W_E_I_G_H_T" in emails.

Instead I suggest that the detection software at ISPs should respond to the spam it detects. This wouldn't effect the few false positives that are found, in fact it would be a service as it would advise them to rephrase their subject line.

Spam works like all mass marketing by fooling a small percentage of those contacted into responding, if a high percentage responded then their system would collapse or at least become a lot more expensive to run. If the detection software used by ISPs harvested the unsubscribe email addresses or links from the spam and responded to them wit false emails then the computers of the spammer would be overwhelmed. AT the every least it would kill the unsubscribe link.

Pinging every spam link discovered would dramatically increase the bandwidth the spammer was using and therefore their costs. 

And low cost is what makes spam so attractive.

That's my contribution to the debate, I don't have the technical expertise to know how to do this but it seems relatively cheap and simple to implement to me.

Richard Warwick

---

From: "Peter A. Friend" <[email-masked]>
Date: 05 Mar 2003 12:29:53 -0800

On Wed, 2003-03-05 at 11:52, Richard wrote:
> Instead I suggest that the detection software at ISPs should respond to the spam it detects.

This a very dangerous and essentially unusable suggestion for reasons
I'll point out below.

> Spam works like all mass marketing by fooling a small percentage of 
> those contacted into responding if a high percentage responded then
> their system would collapse or at least become a lot more expensive
> to run. If the detection software used by ISPs harvested the
> unsubscribe email addresses or links from the spam and responded to
> them wit false emails then the computers of the spammer would be
> overwhelmed. AT the every least it would kill the unsubscribe link.

> Pinging every spam link discovered would dramatically increase the
> bandwidth the spammer was using and therefore their costs.

Problems:

1. How to "detect" the spam in the first place. Didn't you just say
above that spammers will continue to outwit filters? Detection is
essentially the same as filtering in this case.
2. Given a false positive, we would be pinging or emailing a valid non
spammer IP. This is called a Denial Of Service. People get sued for crap
like this.
3. For a large ISP, the outbound pings, emails, whatever to an IP deemed
to be a spammer would quickly cause a problem on outbound links.
Bandwidth costs money.
4. Vigilantism will create more problems than it solves.
5. Could easily be used for a distributed DOS against a person or site.
6. There was someone who suggested this at the recent spam conference in
Boston. It wasn't a popular suggestion for the reasons above and more.

Peter
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 15:53:35 -0500

At 7:52 PM +0000 3/5/03, Richard wrote:
>Instead I suggest that the detection software at ISPs should respond 
>to the spam it detects. This wouldn't effect the few false positives 
>that are found, in fact it would be a service as it would advise 
>them to rephrase their subject line.

This is why everyone is talking about authenticated senders.  You 
cannot reply until you know who to reply to.  The message arrives 
from a machine not owned by the spammer.  The from address isn't 
owned by the spammer.  The web address listed in the email may only 
be up for a matter of hours before it is shut down.  In fact often 
even the domain records get changed by the spammer after the spam has 
been out for a few hours.  Any form of automatic reply promptly turns 
into a very convenient way to abuse innocent bystanders.  It all 
comes back to authentication.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Clifton Royston <[email-masked]>
Date: Wed, 5 Mar 2003 12:03:50 -1000

> comes back to authentication.

  People might want to look at the recently-implemented Postfix
sender verification feature in current snapshot releases.  

  This is only a few months old, but it does, nicely and carefully, a
lot of what people are discussing or asking for.

* In verifying the sender address, it gets as far as connecting, doing
MAIL FROM: <> and verifying a 250/5xx for the RCPT TO, then does a RSET
on the machine it is verifying it on before disconnecting.

* If it gets a 250 for the sender address, it passes that particular
test, and if the other UCE tests pass it will return a 250 acceptance
to the sender.

* If it gets a 5xx, it remembers the address as invalid, and returns a
failure to the sender.

* If it is unable to immediately validate the sender, it returns a 4xx
SMTP code requesting a retry, while it continues attempting the
validation so it will have the answer when they do retry.

* It caches positively and negatively validated sender addresses, so as
not to overload real or forged sender sites with queries.

* It supports whitelisting of various kinds to prevent hammering
mailing list machines.  (In particular those that use VERP in which
case none of the sender addresses will be "valid" as such.)

  Note that with this feature, if a spammer domain has no valid MXes,
or has MX set to 127.0.0.1 or 0.0.0.0, hey presto! They'll never be
able to mail you.  Likewise if they are forging a (fake) user at a
valid domain, the domain owner would probably rather get the validation
query then a whole series of bounces to nonexistent users.

  It's not a magic bullet, but it provides interesting and useful
functionality, and a number of sites are now running it pretty happily.

  -- Clifton

-- 
     Clifton Royston  --  LavaNet Systems Architect --  [email-masked]

  "If you ride fast enough, the Specialist can't catch you."
  "What's the Specialist?" Samantha says. 
  "The Specialist wears a hat," says the babysitter. "The hat makes noises."
  She doesn't say anything else.  
                      Kelly Link, _The Specialist's Hat_
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 17:27:26 -0500

> MAIL FROM: <> and verifying a 250/5xx for the RCPT TO, then does a
> RSET on the machine it is verifying it on before disconnecting.
> 

I've been using exactly this (not postfix, some code I wrote) as a
means of filtering mail for at least six years now.

It used to be a nearly perfect way of blocking spam.  The only 'false
positives' came from people who had broken return addresses, usually due
to mailer misconfiguration.  (so it's not as if you could reply to
them and tell them to fix it...)

For the last year or so, it's been nearly useless for me.

Keith

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 17:45:22 -0500 (EST)

> sender verification feature in current snapshot releases.

This technique is patented and assigned to ESCOM Corporation, in US
Patent #6,321,267 (see the section "Active User Testing")

The patent was filed 23 November 1999; if you think you have prior
art, I encourage you to publish it.

--
David.

---

From: Clifton Royston <[email-masked]>
Date: Wed, 5 Mar 2003 12:53:53 -1000

> art, I encourage you to publish it.

  I certainly don't have any awareness of any; I did not claim to
originate the feature.

  I appreciate your notice, and will forward it to Wietse Venema, the
author of Postfix.

  This is quite annoying.

  -- Clifton

---

From: "Peter A. Friend" <[email-masked]>
Date: 05 Mar 2003 14:58:43 -0800

On Wed, 2003-03-05 at 13:01, Richard wrote:
> Thanks for taking the suggestion seriously enough to respond. However:
> 
> 1.  Yes but the ISPs are detecting millions of spam at the moment and there
> idea doesn't rely on them detecting every single one.

No, but the possibility of being wrong about just one creates problems
and costs far beyond the act of just passively accepting the spam. We
are talking about actions a company will be taking, not some Joe off the
street with a dialup.

> > 2. Once and they are being told that their emails are being seen as spam
> which is a good thing.

Who being told what? You are assuming that an email in a spam actually
maps to a real person somewhere? You haven't been looking at enough
spam.

> > 3. Why? they are using up no more bandwidth than if they were just
> forwarding the spam unfiltered. If the idea worked it will cut the amount of
> spam and therefore free bandwidth.

This is ADDITIONAL bandwidth on top of that of the spam coming in.
Sending an email is a single event, an attack has to last for much
longer to be of any "use".

> > 4. This is no more vigilantism than is the unilateral filtering of the
> spam in the first place.

I completely disagree. Per user filtering is in no way like using a DOS
attack against an IP you believe belongs to a spammer. Unilateral
filtering isn't either. Filtering is not an attack.

> > 5. How?

There is some criteria for determining what is the spam that you have to
respond to. All someone has to do is know what that is and then use that
to generate an email that causes you to "attack".

Peter

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 18:55:37 -0500

On Wed, 5 Mar 2003 17:45:22 -0500 (EST)

> art, I encourage you to publish it.

I wish we could shoot people who file bogus patents.

[astro] ls -l ~/src/check_mail_addr
total 350
-rw-r--r--  1 moore  wheel   4174 Jun 17  1997 822addr.c
-rw-r--r--  1 moore  wheel    149 Jun 17  1997 822addr.h
-rw-r--r--  1 moore  wheel    508 Nov  4  1999 Makefile.in
-rw-r--r--  1 moore  wheel   1141 Oct 11 12:26 README
-rw-r--r--  1 moore  wheel   4007 Oct 10 09:07 check_mail_addr.c
-rw-r--r--  1 moore  wheel     85 Jun 16  1997 config.h.in
-rwxr-xr-x  1 moore  wheel  53976 Jun 14  1999 configure
-rw-r--r--  1 moore  wheel    581 Jun 14  1999 configure.in
-rw-r--r--  1 moore  wheel    541 Jun 14  1999 configure.scan
-rw-r--r--  1 moore  wheel   5201 Jul  8  1997 getmxrr.c
-rw-r--r--  1 moore  wheel    321 Jul  6  1997 getmxrr.h
-r--r--r--  1 moore  wheel   6913 Oct 20  1997 smtp-tcp-bsd.c
-rw-r--r--  1 moore  wheel   2588 Oct 27  1997 smtp-vrfy.c
-r--r--r--  1 moore  wheel   1245 Jun 17  1997 smtp.h
-rw-r--r--  1 moore  wheel    291 Jun 17  1997 strerror.c
-rw-r--r--  1 moore  wheel  84449 Oct 11 12:12 test-data
-rw-r--r--  1 moore  wheel    347 Oct 11 12:24 test-script
-r--r--r--  1 moore  wheel    646 Jun 17  1997 text.c
-r--r--r--  1 moore  wheel    628 Jun 16  1997 text.h

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 18:59:18 -0500

> art, I encourage you to publish it.

for what it's worth, source code to do this has been available since at
least Jul 9, 1997 at ftp://cs.utk.edu/pub/moore/check_mail_addr.tar.gz

if this were enough to get this patent declared invalid, it would make my day.

Keith

---

From: Clifton Royston <[email-masked]>
Date: Wed, 5 Mar 2003 14:16:15 -1000

> if this were enough to get this patent declared invalid, it would

  It probably is, in fact, since it was implemented and published more
than 1 year in advance of the patent filing date, but it typically
takes an actual lawsuit resulting from the holder demanding royalties
to do it.  The patent system is pretty badly broken.

  I also got a note on the Postfix list that exim has been implementing
this since at least 1998.  (Apologies if that's code you were involved
with that they're talking about; can't tell the players without a
scorecard.)

  -- Clifton

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 19:17:21 -0500

> with that they're talking about; can't tell the players without a

as far as I know, they're completely separate.

feel free to forward my email address to anoyone who is fighting this.

(die patent holder scum!)
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Bob Wyman" <[email-masked]>
Date: Wed, 5 Mar 2003 19:29:02 -0500

> typically takes an actual lawsuit resulting from 
> the holder demanding royalties to do it.  The patent 
> system is pretty badly broken.
	Although rarely used, there is a procedure by which anyone can
ask that a US patent be "re-examined" this procedure is documented at:
http://www.uspto.gov/web/offices/pac/mpep/documents/2200_2208.htm#sect22
09

This part of the Manual for Patent Examiners says, in part:
"The reexamination statute and rules permit any person to file a request
for reexamination containing certain elements and the fee required under
37 CFR 1.20(c). The Office initially determines if "a substantial new
question of patentability" ( 35 U.S.C. 303(a)) is presented. If such a
new question has been presented, reexamination will be ordered. The
reexamination proceedings which follow the order for reexamination are
very similar to regular examination procedures in patent applications;
however, there are notable differences. For example, there are certain
limitations as to the kind of rejections which may be made, special
reexamination forms to be used, and time periods set to provide "special
dispatch." When the reexamination proceedings are terminated, a
certificate is issued which indicates the status of all claims following
the reexamination."

---

From: Fred Baker <[email-masked]>
Date: Wed, 05 Mar 2003 16:26:03 -0800

>Instead I suggest that the detection software at ISPs should respond to 

so you want the ISPs to be reviewing the content of your emails and 
applying an acceptable use policy? Interesting, China wants ISPs to do that 
too, and the IETF and my company have been taking a fair bit of flak from 
the civil liberties folks as a result. You might want to rethink that 
position...

>  if a high percentage responded then their system would collapse or at 
> least become a lot more expensive to run.

Not really. They simply state that their return address is someplace that 
doesn't exist (common), or is on some server other than their spam server 
(also common). You can pound the ability to unsubscribe into the ground, or 
ddos some unsuspecting system, but you'll never touch them that way.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 19:41:03 -0500 (EST)

> if this were enough to get this patent declared invalid, it would

No such luck, probably.  You might be able to invalidate one or two claims,
though, which is worthwhile.  Also, knowing about prior art might make the
patent holder reluctant to enforce those particular claims.

Thanks,

David.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 19:22:47 -0500

>on the machine it is verifying it on before disconnecting.

This verifies that the mail from is valid, or is at an ISP that 
doesn't do front-line checking of user validity.  If it becomes wide 
spread then spammers have two obvious solutions.

1. Use real from addresses from real users (but not the spammers of 
course).  This is already happening some, this just makes it worse.

2. Assemble lists of of mail servers that don't immediately validate 
users, but say "yes" to everything.  At which point of course, some 
RBL will be set up to blacklist such servers :-).

I'd put this in the category of techniques that work well only 
because they aren't widely deployed.

---

From: "David F. Skoll" <[email-masked]>
Date: Wed, 5 Mar 2003 22:01:24 -0500 (EST)

> course).  This is already happening some, this just makes it worse.

Even easier, use <> as the sender address.  Or abuse@somedomain,
postmaster@somedomain, or any other address that is very likely to exist.

I'm already seeing an increase in spam from <>.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 22:32:49 -0500

> because they aren't widely deployed.

it doesn't even work well any more.  okay, it does still catch some spam
from naive spammers, but it's nowhere nearly sufficient.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Rod Gilchrist <[email-masked]>
Date: Thu, 06 Mar 2003 12:10:16 -0500

>art, I encourage you to publish it.

I don't think this patent is particularly relevent.

I've attached claim 1 below. In patents claim 1 is the most general of 
all the claims.
In order to violate this patent you must have all three of the described 
filters (and I suspect,
given the phrasing, exactly these three and no more).

More normal language would refer to 'a plurality of filters including 
but not limited to
the following'.

So if you just leave out the dial up reverse connection detection (which 
probably isn't
relevent any more in any case) you aren't violating this patent IMO.

- Rod

1. A system for detecting and selectively preventing reception of an 
electronic message to a local message transfer agent (MTA), the 
electronic message having an address identifying a sender and 
transferred over a connection from a remote host, the system comprising:

a dialup filter determining whether the connection is a dialup 
connection and, if the connection is a dialup connection, terminating 
the connection;

a relay filter determining whether the remote host is an open relay and, 
if the remote host is an open relay, terminating the connection; and,

a user filter verifying whether the sender of the electronic message is 
authorized and, if the sender of the electronic message is not 
authorized, terminating the connection;

wherein, said system establishes communication over the connection 
between said remote host and the local MTA if said system determines 
that the connection is not a dialup connection, said relay filter 
determines that the remote host is not an open relay and said user 
filter verifies the sender as authorized.

---

From: "Bob Wyman" <[email-masked]>
Date: Thu, 6 Mar 2003 16:02:16 -0500

Rod Gilchrist wrote:
> In patents claim 1 is the most general of 
> all the claims.
	Although it is often the case that the first claim is the most
general, this is not a requirement. Claims come in two types: Dependent
and Independent. The dependent claims rely on earlier claims, the
Independent claims do not.
	The specific patent being discussed, USPatent #6321267, has more
than one independent claim. They are: 1, 29, 33,46, 52, 55, 60, and 64.
There is no requirement that claim 1 be more general than any of the
others. Even is such a requirement existed, it would be largely
meaningless since "generality" is something that can't be measured in an
absolute sense. The "generality" of a claim can only become apparent
once the patent is actually applied. 
	It should also be noted that even if an independent claim is
found to be improperly granted, a dependent claim based on the
invalidated claim can still be held to be valid. Proving that the
independent claims are invalid is usually very useful, however, it isn't
sufficient to eliminate the entire patent. Things are not that simple...

		bob wyman

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Rod
Gilchrist
Sent: Thursday, March 06, 2003 12:10 PM
To: [email-masked]
Subject: Re: Patents (was Re: [Asrg] Time for the ISPs to fight back!)

David F. Skoll wrote:

>>  People might want to look at the recently-implemented Postfix sender

>>verification feature in current snapshot releases.
>>    
>>
>
>The patent was filed 23 November 1999; if you think you have prior art,

>I encourage you to publish it.
>  
>

filters (and I suspect,

probably isn't

- Rod