Subject: [Asrg] Deprecating plain POP accounts

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 11:43:02 +0100

Hi,

after having lots of discussion about spam and my
draft with people from around the world and after following
the asrg group for two days now, I believe to have identified
a major barrier in fighting spam. It's the ubiquituos

  "I demand/need to send any mail with any sender address 
   from anywhere in the world."

But what's the background for this? When in the history
of e-mail did this arise and why?

The reason is simple: It's mainly the POP account.

People need to exchange e-mail from virtually anywhere,
whether from home with a dynamically allocated IP address,
of from any phone plug in a hotel right in the middle of nowhere,
with an IP address of any local ISP. That's OK, I agree with that.
I do it the same way.

But there's a harmful and irrational asymmetry in the mail path:

When receiving e-mail, people find it fully acceptable and just
normal and natural to 

- have a central mail hub receiving their e-mail, operated by some
  kind of ISP,

- that hub to have a fixed IP address and to be linked to their
  domain/e-mail address through DNS

- that this mail hub is worldwide responsible and authorized 
  for their domain/e-mail address in context of e-mail reception

- to identify and authorize against that hub before downloading their
  e-mail through POP. 

That's fine and I never found anyone who seriously wanted to question
this. 

But when sending e-mail, things dramatically change:

- Many ISPs deny to support their clients in mail delivery.

- Even if they do, most clients deny to use it.

- Instead, clients insist on directly deliver their email 
  to the world through SMTP without any authorization/authentication.

That's counterproductive and harmful, since there is no technical 
difference between this and forged/unsolicited e-mail.

The obvious, self-evident, and reasonable way would be to use the
same path as for receiving e-mail, just in opposite order:

- the client doesn't send e-mail directly to the recipients MX
  machine, but instead drops it to its mail hub after authentication. 
  (The mail hub might apply further services such as virus scanning.)

- The mail hub then delivers the mail to the world and is considered
  to be responsible and authorized to deliver mail from that domain.
  The hub still has a fixed IP address which is linked to the domain.

Would be a perfect symmetry. Deliver the same way and method as you
receive.

Surprise: That already exists. Many POP providers also offer the
service of delivering the mail. Authentication is possible through 
either a so called "SMTP after POP" or a simple Password
authentication in the SMTP protocol, typically the same password as for 
the POP account. 

That's perfect, it does the job, and it's already implemented and
publicly available. And after all, it even works better for the client
than direct delivery, since the client doesn't need to cope with 
unavailable DNS servers or other relays. And it is not even 
a limitation, since the client depends on the presence of the 
mail hub anyway. Life could be so easy and simple.

Unfortunately, too many ISPs and clients refuse to use it.

Therefore I suggest to declare as deprecated:

- ISPs who offer reception (POP) services without offering 
  delivery (SMTP) services.

  If POP download is possible from a given IP address a.b.c.d, 
  then SMTP delivery must be possible as well with the same
  set of authentication information, i.e. same username and password.

  Message receiving through POP must be bundled with message delivery.

- Clients downloading e-mail through POP, but not using the 
  bundled delivery service. (That's btw poor client configuration.)

That's a quite simple demand. No need to develop new software. Most
software out there is already able to handle this, just needs to be
configured appropriate. 

Once people follow this, the "I need so send e-mail from anywhere when
I'm on road" objection vanishes into thin air.

Once this happened, the door is open to implement a sending relay
authentication, maybe through RMX records or cryptographic certificates.

Hadmut

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 06:35:38 -0500

> with an IP address of any local ISP. That's OK, I agree with that.

  Let me re-phrase that:

    "People need to be able to send email from anywhere, to anyone,
     using any email address they choose."

  I don't think that's a good idea.

>   to the world through SMTP without any authorization/authentication.

  Too bad.  I can't drive 200 MPH on city streets, much as I may like
to.

  There are technical solutions to this problem.  Authenticated SMTP
exists, and should be used.

  It's ugly to to create hacks to work around the fact that people are
unwilling to use existing protocols.  It just makes the problem worse.

  Alan DeKok.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 12:08:39 -0500

I do it the same way.
>   I don't think that's a good idea.

the people who need to do this don't care whether you think it's a good
idea or not.

the place where you happened to be connected to the network has nothing
to do with your identity.  to the extent that there is a correlation
now, it will get less useful as time goes on, because networks are
becoming more diverse.

>  I can't drive 200 MPH on city streets, much as I may like to.

driving 200 miles per hour causes problems.  submitting mail from random
places on the net does not.

> unwilling to use existing protocols.  It just makes the problem worse.

you have it backwards.  authenticated smtp is a clean solution; tying
identity to network location is a hack.

Keith

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 07:27:47 -0500

> the people who need to do this don't care whether you think it's a good

  My statement may have been unclear.  I agree they need to send
email. I don't agree that they need to be the SMTP originator, and to
connect to any SMTP destination.

  Authenticated SMTP allows them to relay via a well-known home
server.  HTTPS allows them to tunnel that traffic through broken
filters at remote sites.

> places on the net does not.

  I disagree completely, and I won't argue about it.  SPAM is a DDoS
attack, originating from SMTP senders with random IP's.  That's a
problem.

  If getting rid of the "random SMTP sender" problem means that the
roaming user is required to use a home server, then that's fine.  It
stops the spammer, and has little cost to the roaming user.

> identity to network location is a hack.

  Hmm.. I don't think I wanted to tie identity to network location.

  If a user from your domain is roaming, and wants to send email, I
don't see why it's *my* problem to authenticate him.  Your laziness is
requiring me to:

    - allow SMTP from any IP
    - allow those people to claim to be anyone
    - allow those people to send to any of my users

  That looks a *whole* lot like spam to me.  I'm inclined to
bit-bucket your roaming users into the same garbage bin as spammers,
because I *can't tell them apart*.

  In contrast, if I can guarantee that:

    - SMTP comes only from machines which *intend* to send SMTP
    - DNS for a domain tell you which machines intend to send SMTP
    - email from users at a domain originates only from SMTP servers
      for that domain

  Then that looks like a pretty good solution to 99.9% of the spam
problem.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Wed, 5 Mar 2003 11:24:06 -0500

>authentication in the SMTP protocol, typically the same password as for

If this were a solution, then ISP's wouldn't be blocking outbound 
SMTP connections.

Since there is no way to tell the difference between an outbound SMTP 
session from a client, and one from a server, your solution provides 
a mechanism for authorized delivery, but does not require it. 
Therefore the user sets up mail broadcaster at some safe location (or 
uses open relays) and sits happily at home using his ISP to send out 
email.  From the ISP's standpoint this looks just like legitimate 
use.  But he's spamming like crazy, and it's the ISP that gets the 
complaints.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 13:37:03 -0500

> > driving 200 miles per hour causes problems.  submitting mail from
> > random places on the net does not.
> 
> attack, originating from SMTP senders with random IP's. 

legitimate mail originates from random IPs also. 

> stops the spammer, and has little cost to the roaming user.

no, it doesn't stop the spammer.  it just makes life harder for
legitimate users.

just because spam is bad doesn't mean it's a good idea to impose any
random and useless barrier on ordinary people's ability to send mail
that someone comes up with.

> > you have it backwards.  authenticated smtp is a clean solution;
> > tying identity to network location is a hack.
> 

that's just what happens when you try to make IP addresses significant.

> don't see why it's *my* problem to authenticate him. 

you're not authenticating him in any event. source IP addresses are not
authentication.  and domains have nothing to do with IP addresses. 

>   Then that looks like a pretty good solution to 99.9% of the spam

only because you haven't thought it through.  many spammers use
throwaway accounts anyway.  the fact that they are using their ISP's
SMTP server to relay spam doesn't keep them from spamming.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 19:52:02 +0100

>      using any email address they choose."

No. You re-phrase it to the opposite.

I said: exchange from anywhere with any IP address. I didn't say
"send" in the context of SMTP. And I didn't say send to anybody. 

I meant: Exchange e-mail with my home mail hub to download incoming
mail and to upload outgoing mail. No IP traffic with any other machine
at all, so the local IP address doesn't matter in any way.

> > - Many ISPs deny to support their clients in mail delivery.

Many do. And other's will follow once symmetry is defined as a standard.

> > - Even if they do, most clients deny to use it.

Most clients don't deny it, they just don't use it because they don't
know it. No denial, just poor configuration. 

>   Too bad.  I can't drive 200 MPH on city streets, much as I may like

Huh? What are you talking about???

> exists, and should be used.

Yes, but how does that fit to your former statement?

Maybe you're confusing authenticated SMTP a little bit?

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 20:02:58 +0100

> stops the spammer, and has little cost to the roaming user.

It's even better than having "little costs": It it cheaper than
delivering directly.

I'm doing it this way for several years now and it proved to be
much better than direct SMTP delivery. When I dial in with my
notebook, it opens a uucp over ssl connection to my home server,
to download incoming mail and to upload outgoing mail. Since I use
bsmtp, the mail is compressed.

It has those benefits:

- Single action to down- and upload all messages queued on both
  machines. Only a single TCP connection required.

- Much faster than SMTP due to the compression

- Always fully encrypted, no chance for eavesdroppers

- Works without DNS

- doesn't need to wait for other SMTP relays to be available

- doesn't need to wait for other SMTP releays to positively
  reply a DATA command which can take several minutes

- Home server is always connected to the internet and automatically
  tries to resend the message if the receiving relay is unavailable or
  answered a 4xy code.

So having a central home hub does not even cause only little costs,
it is much better, cheaper, faster, and more effective than direct
SMTP delivery. 

Hadmut

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 20:33:44 +0100

> no, it doesn't stop the spammer.  it just makes life harder for

Could you elaborate this? I don't see how this should make 
life harder. In my experience, it makes legitimate users's life much
easier and cheaper.

> authentication.  and domains have nothing to do with IP addresses. 

Currently domain have nothing to do with IP addresses.
Currently we have a severe spam problem.
Maybe it's not so wise to insist on keeping the current status quo.

> SMTP server to relay spam doesn't keep them from spamming.

Again, could you elaborate? 

If they had to use their ISP's SMTP server, this server will stop them
using wrong domains. That's the first step to stop spam.

Hadmut

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 10:06:14 -0500

> legitimate mail originates from random IPs also. 

  I thought that legitimate email originated only from mailers that
administrators had configured to send mail.

   Q: Why are open HTTP proxies allowed to relay email?

   A: Because no one at the site notices that they can send mail,
      and no one receiving the mail knows that that machine was
      not intended to send mail.

  Any mail system which allows such nonsense is broken.

> no, it doesn't stop the spammer.  it just makes life harder for

  Ah, I see.  In order for your "legitimate users" to save small
amounts of effort, you require others to accept massive volumes of
spam.

  That's the cost of your roaming user requirements.

> authentication.  and domains have nothing to do with IP addresses. 

  <sigh> If I want to be able to distinguish his traffic from spam,
then there must be some way for me to do that.  Maybe "qualifying" is
a better word to use.  Filters "qualify" email as valid.

  So your roaming user requires me to do extra work to filter,
qualify, or authenticate them, because the traffic doesn't originate
from the domain he claims to be sending from.

  Can I bill you for that extra time and effort?  If not, why should I
care about accepting email from such broken systems?

> SMTP server to relay spam doesn't keep them from spamming.

  That traffic is less than .01% of the spam I'm seeing.  It's so far
off of my radar that it's indistinguishable from normal email traffic
for me.

  The spam you're worried about is so inconsequential that if my
domains were getting it, I wouldn't even be on this list.  It just
wouldn't be a problem.

  Alan DeKok.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 16:21:56 -0500

> > > roaming user is required to use a home server, then that's fine. 
> > > It stops the spammer, and has little cost to the roaming user.
> > 

there are legitimate needs to be able to send SMTP from random
places on the Internet, even from dialup lines.  preventing users from
doing so makes it easier for the ISP to trace complaints, but it really
doesn't prevent people from spamming.  it just means they have to use
throwaway accounts.

> > you're not authenticating him in any event. source IP addresses are
> > not authentication.  and domains have nothing to do with IP
> > addresses. 
> 

that's like Mr. Bush's logic: 
no matter what the source of the problem is, bomb Iraq.

maybe it's not wise to impose barriers that block legitimate use,
decrease network transparency, and don't actually solve any problem.

> using wrong domains. That's the first step to stop spam.

there's no such thing as a wrong domain.  people need to be able to
originate mail from other domains than the ISP's.  and it won't stop
spam, because the spammers will just use throwaway accounts.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:09:44 +0100

On Wed, Mar 05, 2003 at 04:21:56PM -0500, Keith Moore wrote:
> places on the Internet, even from dialup lines. 

Maybe it would be easier to follow you if you gave 
an example.

> no matter what the source of the problem is, bomb Iraq.

I didn't ask to bomb. I asked to question whether the
given statement could be held. So I asked to start thinking,
not bombing.

> originate mail from other domains than the ISP's. 

I never doubted this. 

Of course people need to originate mail from other domains than
the ISP's. That's obvious and nobody denied it.

But people don't need to be able to originate mail from any
domain they want. They need to be limited to the domains they're
authorized to use (by the domain owner).

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 17:11:36 -0500

> administrators had configured to send mail.

anybody who has a computer is potentially an administrator.

>   Any mail system which allows such nonsense is broken.

why.  because you said so?  

is hotmail broken too?  it allows people to relay mail.  it doesn't know
who is really sending it.

> amounts of effort, you require others to accept massive volumes of

nope.  these blocks don't do much to deter the massive amounts of spam.

> > source IP addresses are
> then there must be some way for me to do that. 

well, I suppose it depends on how you define spam.  everybody has his
own definition. 

now maybe it really would be useful to be able to ask some oracle
"did the guy who sent this message also send out thousands of 
other similar messages?"  and "were there lots of complaints about
those messages?"  but that's not the same thing as blocking port 25.

> from the domain he claims to be sending from.

domains are just names.  traffic doesn't originate from domains.

>   Can I bill you for that extra time and effort?

can I bill you for taking my time to try to explain this to you?

YOU DO NOT HAVE THE RIGHT TO INSIST THAT INTERNET TRANSPARENCY BE
CRIPPLED FOR THE SAKE OF SOME BRAIN-DAMGED IDEA THAT WILL DO NO GOOD.

is that clear enough?  that will be $100, please.

> If not, why should I

don't accept the mail if you don't want to.  for that matter, don't
accept any mail at all.  you'll be far better off.  and so will we.

> > many spammers use
>   That traffic is less than .01% of the spam I'm seeing.  

traffic from throwaway account is < .01% of the spam you're seeing?
well, the rest of the net is getting the other 99.99% of such traffic,
because every time I look at spam most of the sender addresses are
fairly obvously throwaways. 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 17:21:57 -0500

> Maybe it would be easier to follow you if you gave 

Imagine a mobile network, say one that is used in emergency situations. 
It gets its internet connectivity via whatever means is available in
whatever location it finds itself - which might be WLAN, WMAN, dialup,
cell phone, satellite, whatever.   This might change from one hour to
the next.  The network has several dozen hosts, mostly laptops. It has
its own mail and DNS servers.  It's not acceptable to have to
reconfigure the hosts in this network every time its means
of connectivity changes.

> given statement could be held. So I asked to start thinking,

clearly something about the status quo needs to change.  it would be
very unfortunate if we compromised transparency, or the ability to send
anonymous mail, for the sake of spam.

> authorized to use (by the domain owner).

I don't disagree in principle.  But we're a long way away from having a
mechanism that would allow recipients to verify whether the sender has
the "right to use" the domain.  The protocols are the easy part; what's
hard is that this requires upgrading essentially every piece of mail
software in existence, as well as a fair amount of infrastructure
(espeically if you want to avoid various kinds of DoS attacks).

Keith

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 12:30:10 -0500

Keith Moore <[email-masked]> wrote:
> >  [ mail from non-mx machines ]
> >

  Because the behaviour of the network (machines originating mail)
does not match the intended behaviour.  This isn't hard to see.

> those messages?"  but that's not the same thing as blocking port 25.

  Any solution I'm interested in doesn't involve filtering, data
collection, or counting how much email someone sends.  It should be
possible to perform simple checks.

  e.g. The recent postfix checks.  No MX?  Nowhere to send bounces?
According to the RFC I shouldn't accept the mail, because there's
nowhere to send a possible bounce.

  e.g. Domains making positive declarations "Mail from my domain
originates only from IP X".  DUL lists become irrelevant.
Misconfigured HTTP proxies become irrelevant.

  These sort of solutions are nearly zero cost, and can have a
significant impact on the volume of spam.

> domains are just names.  traffic doesn't originate from domains.

  So when someone sends email FROM "[email-masked]", his traffic
isn't originating from any domain.  When his IP resolves to
"ppp2723.isp.com", I shouldn't care that he's lying to me about who he
is, and where his email is coming from.

> CRIPPLED FOR THE SAKE OF SOME BRAIN-DAMGED IDEA THAT WILL DO NO GOOD.

  Having an open mind doesn't mean you let your brain fall out.
Having a "transparent" network (whatever that means) doesn't mean it's
total anarchy.

> traffic from throwaway account is < .01% of the spam you're seeing?

  ... from known "good business" ISP's, yes.

> fairly obvously throwaways. 

  Don't make me laugh.  The sender addresses are forged.

  I've had a *hell* of a time convincing people that I don't want to
see "helpful" notifications about mail with forged addresses from my
domain, seen in a spam message (sender, body, etc).  Two years ago, I
was receiving more such notifications than spam most people received.

  Alan DeKok.

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 5 Mar 2003 23:45:54 +0100

> reconfigure the hosts in this network every time its means

I don't see how this could be an argument for your opinion.

I'm using several notebooks with the mail scheme I proposed. 
I'm using them in various sitations, at home, at the office, in 
Wavelans, in the University, in business trips with a modem,
I was even travelling through Australia and New Zealand with it.

And I never ever had to reconfigure anything. On the contrary:
The fact that I use my central relay make the configuration
so stable that I never need to change anything, I do not even
need a running DNS service. 

So your example is actually an argument for my proposal...

> anonymous mail, for the sake of spam.

I understand that this is a bitter pill, but you can't have one
without the other, since it turns out to be basically the same.

> the "right to use" the domain.

That's what we're here for. Nobody said it would be easy. :-)

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 18:05:12 -0500

> need a running DNS service. 

you're not connecting to different ISPs, each of which insist that you
use their relay, and block port 25 for all other hosts.

> > very unfortunate if we compromised transparency, or the ability to
> > send anonymous mail, for the sake of spam.
> 

please also understand that we might not want to swallow that bitter
bill.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 00:13:45 +0100

> use their relay, and block port 25 for all other hosts.

Sure, of course I do. I do not even use port 25 since I don't 
use SMTP to up/download mail from my home hub.

> please also understand that we might not want to swallow that bitter

Sure I understand. Take the pill or stay sick.

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 18:52:44 -0500

> does not match the intended behaviour.  This isn't hard to see.

*whose* intended behavior?  it certainly matches the sender's intended
behavior.  and it's perfectly legal according to the standards, with
good reason.

> collection, or counting how much email someone sends. 

nobody says you have to use it.  you can decide whether to accept mail based
on the phase of the moon if you want.

> nowhere to send a possible bounce.

you can accept it if you wish.  you just can't bounce the mail.

> originates only from IP X".

there's nothing horrible about that, but it's not generally useful.
people need to be able to send mail from arbitrary locations on the
net.  nor is it a good idea to tie IP addresses to domains.

> isn't originating from any domain. 

you've got it.

> When his IP resolves to

you don't know from the above information whether he is lying or not.

this mail is originating from some earthlink.net IP address;  the return
address is [email-masked].   it's perfectly valid for me to be using that
return address to send mail from that IP, or from any other IP that my laptop
happens to be connected to.  I don't want to receive mail at my earthlink
email address, and if you sent mail there, chances are I would never see it.

>   Don't make me laugh.  The sender addresses are forged.

many of the ones I see are perfectly valid. the sender gets the spam sent out
long before the account gets shut down.

> domain, seen in a spam message (sender, body, etc). 

well I don't like it when spammers use my return address either (which they've
done once or twice).  but IP address is simply not very useful as an
authentication token, and it's getting less useful for this over time.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 14:04:57 -0500

> behavior.  and it's perfectly legal according to the standards, with

  Can I cry now?  Are you even reading what I write?

  My example involved a machine which was NOT intended to originate
SMTP.  Due to misconfiguration/bugs, it does.  The machine
administrator never intended the spammer to be able to send spam
through that machine.  Yet the spammer can do so.  This is a problem
for everybody but the spammer.

  I don't *care* about the intended behaviour of the spammer.  They're
abusing systems they were never intended to have access to.  That
abuse is causing other people problems.

> net.

  Why?  Are there NO solutions to the roaming problem, other than
allowing any IP on the net to originate SMTP to any other IP, and
claim to be from any domain?

  I believe that such solutions exist.  They should be used.  I
believe that using them will help minimize the spam problem.

> happens to be connected to.

  Why?  You're stating it like it's an axiom, or a law of nature.

  Is it really impossible for you to connect to a well-known SMTP
server, which can verify you, and verify itself as a well-known SMTP
server to others?  Do you understand why such behaviour will make it
orders of magnitude easier for other SMTP servers to "qualify" SMTP
sources, and to filter out spam?

  Alan DeKok.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 19:15:18 -0500

> SMTP.  Due to misconfiguration/bugs, it does.

that's what you get for running (probably) microsoft.  don't expect us to
impair the rest of the network to accomodate their brain damage.

> claim to be from any domain?

there is no good reason to require them to do so.

> > address is [email-masked].   it's perfectly valid for me to be using
> > that return address to send mail from that IP, or from any other IP that
> > my laptop happens to be connected to.
> 

it's the way mail is supposed to work.  it's consciously chosen and highly
desirable behavior.

> server to others? 

yes.  furthermore, it would be undesirable to force people to connect to
servers that verified their identities.

Keith

---

From: "Gary Feldman" <[email-masked]>
Date: Wed, 5 Mar 2003 19:32:17 -0500

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Keith Moore
> Sent: Wednesday, March 05, 2003 6:53 PM

> return address to send mail from that IP, or from any other 

How do I know it's valid?  And if I can't tell whether it's valid,
what reason do I have to accept it?  (Setting aside, for the moment,
that the mail has been passed through a list server that has
some controls.)

I can't imagine any reason why, in theory, I would ever want to accept 
mail with a return address that I can't validate.  If you want to,
that's
you're right, but that doesn't mean that other people - whether 
end-users or mail service operators - should.  In actual practice,
people
accept such mail not because they like to get invalid mail, but because
the validation mechanisms aren't in place. 

Since someday I might actually want to receive mail from someone not
able
to send from their return domain - it means that a way to validate
such emails would be useful.

Gary

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 20:12:51 -0500

On Wed, 5 Mar 2003 19:32:17 -0500
"Gary Feldman" <[email-masked]> wrote:

> > this mail is originating from some earthlink.net IP address;  
> > the return address is [email-masked].   it's perfectly valid for me to
> > be using that return address to send mail from that IP, or from any other

> How do I know it's valid?  

the same way you know any address is valid - unless the message is signed by a
party that you trust, you don't.  the IP address certainly doesn't tell you
that it's valid.

> And if I can't tell whether it's valid,
> what reason do I have to accept it? 

because you want to read it?  because in general there's no way for you to
know whether any sender address is valid?  because chances are, you're not
evaluating the content of this message based on who said it anyway, but based
on how much sense it makes to you.  *who* said it is mostly irrelevant.

> mail with a return address that I can't validate.

since you probably can't validate ANY email that you receive, why do you read
mail at all?

do you read snail mail that you can't validate?  why?  it might contain spam,
or worse, anthrax....

Keith

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 05 Mar 2003 16:42:45 -0500

> impair the rest of the network to accomodate their brain damage.

  Ad hominem attacks don't validate your position.  Reasoned,
evidence-based arguments validate your position.

> it's the way mail is supposed to work.  it's consciously chosen and highly

  Ah.  So it's an axiomatic property of the network, and you're
unwilling or unable to justify your position.  Thanks for verifying
that little bit of nonsense.

> servers that verified their identities.

  Why?

  Oh, never mind.  You've made it clear that you have no intention of
showing *reasons* for your opinions.  Everyone should just believe you,
because (by Jove) they're *you're* opinions.

  <plonk>

  Alan DeKok.

---

From: Keith Moore <[email-masked]>
Date: Wed, 5 Mar 2003 22:31:36 -0500

> evidence-based arguments validate your position.

fair enough.  so I'll state the same thing with less flamage:  if you have
software bugs, the thing you need to do is fix your software, not expect
people to degrade the flexibility of the network.  the network needs to be
predictable and behave in a uniform fashion, independently of location, if
software is to be able to work correctly from one machine to another, and one
location to another.

> > > > this mail is originating from some earthlink.net IP address;  the
> > > > return address is [email-masked].   it's perfectly valid for me to
> > > > be using that return address to send mail from that IP, or from any
> > > > other IP that my laptop happens to be connected to.
> > > 
> unwilling or unable to justify your position. 

it's not an axiom.  it's part of the design.  it is desirable for domains to
be independent of network location (for instance, so a domain can encompass
multiple locations that are distant from one another, or so a domain can have
multiple network prefixes -- but more generally because domains are not
intended to name locations in the network topology).  it's also part of the
design that email addresses are not tied to locations in the network, and that
the From address is settable by the originator.  if you look at RFC 822 then
you'll see examples of this.

> > servers that verified their identities.

because anonymous speech is valuable, and valuable speech can be suppressed
when people are not allowed to speak anonymously.

Keith

---

From: abuse <[email-masked]>
Date: Wed, 5 Mar 2003 23:55:16 -0800 (PST)

... somehow, the idea of 'eliminating' "POP" accounts falls short of a
reasoned solution.  if i'm mistaken, and this a viable alternative, why
not eliminate SMTP altogether ...

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 10:29:32 +0100

> not eliminate SMTP altogether ...

Maybe you'd understand it a little bit better if you'd read more
than just the subject line. 

POP accounts are not to be "eliminated", they are to be bundled
with SMTP relay services. The solution already is implemented in
most modern MUAs for at least year now. 

Hadmut

---

From: abuse <[email-masked]>
Date: Thu, 6 Mar 2003 17:56:09 -0800 (PST)

on "3-6-2003" "Hadmut Danisch" writ:

: On Wed, Mar 05, 2003 at 11:55:16PM -0800, abuse wrote:
: >
: > ... somehow, the idea of 'eliminating' "POP" accounts falls short of a
: > reasoned solution.  if i'm mistaken, and this a viable alternative, why
: > not eliminate SMTP altogether ...

: Maybe you'd understand it a little bit better if you'd read more
: than just the subject line.

... i do not have 'quotable' text at my disposal, but as i recall, you'd
suggested a mandated 'change' to the system as it now stands.  if that in
error, i certainly stand corrected.  however, if i'm not, my opinion
about that philosophy has not changed ...
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg