Subject: [Asrg] taxonomy of solutions, including some new items

From: Liudvikas Bukys <[email-masked]>
Date: Mon, 10 Mar 2003 13:30:51 -0500

Here is a taxonomy I did over the weekend.  I tried to bend it into
a list of additions to Paul Judge's, but I feel that the categories
overlap and that both the Paul Judge draft and the Hadmut Danisch draft
offer a premature binding to processes or dataflow.  For example, many
of the classifiers contribute something to both identifying unwanted or
identifying unwanted.

For ease of use, '+' marks new items that I have not observed on previous
lists, but which are already "out there" being implemented by somebody,
and '**' marks items that nobody has implemented yet (that I am aware).

Taxonomy of solutions

    - content filtering
        - heuristics (content, headers, paths, combinations of any feature below)
        - learning

    - network-address-indexed blacklists
        - open relay blacklists
        - open proxy blacklists
        + dialup lists
    - content-indexed blacklists
        - bulk detectors (DCC)
        - collaborative filters (Razor, Pyzor)
        ** URLS and phone numbers

    - sender whitelists
        - basic recipient-administered
        - sender verified as human
            - challenge/response, Turing test
        - third-party trust/reputation
    - recipient whitelists
        - tagged/disposable addresses
    - sender accountability
        - digital signature
        - non-repudiation
        + auditing-based (Bonded Sender)

    - sender pays
        - proof-of-work/cycles (hashcash)
        - micropayments

    - protocol hints or restrictions
        ** associate permissible (env-sender,src-addr) (RMX, Designated Sender, Vixie MAIL_FROM)
        - rate limiting (ingress or egress)
        + teergrube/tarpit

    + honeypot spam recipients for rapid acquisition/analysis of spam content (MessageLabs commercial service)

    ** consent verification

    - legal
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Liudvikas Bukys <[email-masked]>
Date: Mon, 10 Mar 2003 13:57:21 -0500

Just a few comments on what I called the unimplemented ideas in
my preceding note on taxonomy of solutions:

** consent verification

	When I saw the ASRG charter, I leaped to the conclusion that a
	consent model would be useful for two reasons:	(1) to contribute
	to a rigorous careful discussion, and (2) to produce human- and
	machine-readable representations of consent that would be useful
	for such things as:
	- reducing the "I didn't know any better" gray-area excuse of
	  spammers regarding opt-in, opt-out, and database reselling
	- making life better for users by causing practices to converge on
	  consent that is explicit, self-documenting and user-accessible,
	  establishing standardized representations (similar to DSNs),
	  and offering choices that are "good enough" but much lighter-
	  weight than, say, PKI.

	Is this what the chair was thinking?

	[Let me also leap ahead and say that, yes, legitimate large
	emailers would benefit from explicit consent standards, but,
	no, I am not a "friend of spammers".]

	Actually I believe that Paul Graham touched on this, regarding
	what you do to analyze content when the message body itself is
	driven by content filters to become innocuous.	Presumably all
	spam other than DoS spam has some ground to the real world in
	order to make transactions.

	We've had lots of discussion on this already.  Forgive me if I'm
	wrong in lumping all three proposals into an equivalance class.
	Although wide adoption would be a significant change of lifestyle
	for many, it is (as Vixie's document notes) a voluntary effort by
	domain owners and MTA operators.  The benefit of some "joe job"
	reduction, plus its voluntary adoption, seems like a "do no harm"
	to me.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg