Subject: RE: [Asrg] In case anyone thought Barry was exaggerating

From: Paul Judge <[email-masked]>
Date: Thu, 3 Jul 2003 11:19:05 -0400

> -----Original Message-----
> From: Alan DeKok [mailto:[email-masked]] 
> Sent: Thursday, July 03, 2003 10:44 AM
> To: [email-masked]
> Subject: Re: [Asrg] In case anyone thought Barry was exaggerating 
> 
> 
> Walter Dnes <[email-masked]> wrote:
> >   In late December, I got an account at clss.net that 
> allows end-users 
> > to set up individual blocklist selections and whitelists.  
> Processing 
> > takes place just after RCPT:, and rejections consist of the 
> big 550, 
> > not the mailbombing of innocent 3rd-parties that have been 
> forged as 
> > the "From:" address.
> 
>   In the past few weeks, I've started receiving a number of 
> such idiot bounces every day, to all of my public email addresses.
> 
> > My spam count on this account has gone down from multiple spams per 
> > day to multiple days between spams.
> 
>   Wonderful.  Does this work for AOL?  Nortel?  Hotmail?  Striker?
> 
>   Not really.  (Or, not without substantial cost.)  And what 
> do you do when the spam load goes up by a factor of 10, as it will?
> 
>   If such a solution could get rid of the vast majority of 
> spam, then we wouldn't need ASRG.  But it can't, and it won't 
> scale to the future.  As previous discussions on ASRG have 
> shown, the amount of spam can increase by a factor of 10 to 
> 100, before it starts to dominate the network.

I did not see his message suggesting that this was a solution to the 'global
problem' of spam. I do think that this is an interesting perspective on the
differences between various spam responses. This is closely related to the
conversation around giving temporary failures to suspect messages.

Of course, in all of this there is place for the counter-argument that this
describes spammers' current behavior and that behavior can change. I do not
think this should stop us from at least gaining an understanding of it. With
all of this, we must understand the assumptions that the proposal is based
upon and consider the effect of changes in those conditions.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Thu, 03 Jul 2003 13:53:36 -0400

Paul Judge <[email-masked]> wrote:
> problem' of spam.

  I agree.

  My point was more that local band-aids help, but only for short
periods of time.  Everyone on ASRG should already know this.  If the
band-aids were *permanently* effective, then ASRG would be
unnecessary.

  Alan DeKok.

---

From: Walter Dnes <[email-masked]>
Date: Fri, 4 Jul 2003 13:17:23 -0400

On Thu, Jul 03, 2003 at 01:53:36PM -0400, Alan DeKok wrote
> > I did not see his message suggesting that this was a solution to
> > the 'global problem' of spam.
> 
>   I agree.
> 
> band-aids were *permanently* effective, then ASRG would be unnecessary.

  A permanently effective solution simply doesn't exist.  It implies a
static problem.  Spammers adapt their tactics to whatever defenses we
evolve.  The best defense is a multi-faceted one.  Anybody who reads
comp.risks should be familiar with the concept of multiple redundancy
for systems, so that the failure of one portion doesn't shut down
everything.

  Adopting "the one true global spam solution" risks everybody being
mailbombed with ads when a hole is found in that one solution.  A lot of
different "local band-aids" are less likely to fail simultaneously.  And
if we use what the military refers to as "defense in depth", the failure
of one component will merely cause other components to trap more spam.
The mission of ASRG should be to keep coming up with new anti-spam
strategies as the old ones are circumvented.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did