Subject: [Asrg] asrg-cri - spam to mailing lists ?

From: "Radu Hociung" <[email-masked]>
Date: Wed, 17 Mar 2004 12:11:54 -0500

Hello all,

I've been following the group for a while, and I can't find the answer I'm
looking for:

1. About the challenge-response draft document: Are your intentions to make
it into an RFC? Is it a possibilty that it can/will become a mainstream
standard?

2. About the contents: If a spammer would add headers to his message to
make it look like a mailing list, this message would then not be subject to
the other provisions of the draft? Is there a separate draft/RFC to deal
with the mailing list/CR combination, or do you intend to address this in
some way?

Thank you in advance.
Radu.
--
Radu Hociung                                                 [email-masked]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 17 Mar 2004 12:22:27 -0500

> it into an RFC? Is it a possibilty that it can/will become a mainstream

I am assuming you are refering to the following:

http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt

There has been very little feedback at all on this document, so it looks 
to me that there is very little interest in this kind of stuff. 
Something only has a chance of becoming a standard if people are willing 
to support it and so far no one has been.

> with the mailing list/CR combination, or do you intend to address this in

As the draft is written now in section 4.2 lists can be exempt, but we 
were planning on dealing with this in the future, IF sufficient interest 
would be shown in the idea. So far no interest was shown and as a matter 
of fact, the document is about to expire.

Yakov

---

From: "Eric Dean" <[email-masked]>
Date: Sat, 20 Mar 2004 09:50:40 -0500

If a spammer included exempt headers then the process would not be
automated and the message would be subject to manual deletion.  The
intent is that valid email would automatically be delivered and anything
else would do something else.

> 2. About the contents: If a spammer would add headers to his 
> message to make it look like a mailing list, this message 
> would then not be subject to the other provisions of the 
> draft? Is there a separate draft/RFC to deal with the mailing 
> list/CR combination, or do you intend to address this in some way?

---

From: "Radu Hociung" <[email-masked]>
Date: Wed, 24 Mar 2004 16:13:29 -0500

Exactly. If the process of deleting such spam is not automated, then the
spam protection is not really protecting anything, and in fact it makes the
spam problem worse by providing a mechanism of guaranteed delivery.

Is it not the consensus that spam should be prevented from reaching the
mailbox?

---

From: "Eric Dean" <[email-masked]>
Date: Thu, 25 Mar 2004 10:38:04 -0500

Certainly that is implied.  And anyone building CR systems would be wise
in doing so.

We are merely specifying a protocol.  The actual implementation of that
protocol and the actions that are taken based upon specific messages are
up to individuals.

The intent was to see if this protocol provided a comprehensive set of
messages for CRI.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Radu Hociung
> Sent: Wednesday, March 24, 2004 4:13 PM
> To: 'Eric Dean'; [email-masked]
> Subject: RE: [Asrg] asrg-cri - spam to mailing lists ?
> 
> 
> Exactly. If the process of deleting such spam is not 
> automated, then the spam protection is not really protecting 
> anything, and in fact it makes the spam problem worse by 
> providing a mechanism of guaranteed delivery.
> 
> Is it not the consensus that spam should be prevented from 
> reaching the mailbox?
> 
> 
> 
> >intent is that valid email would automatically be delivered and 
> >anything else would do something else.
> >
> >

---

From: "Radu Hociung" <[email-masked]>
Date: Thu, 25 Mar 2004 11:15:17 -0500

In that case, I really think the proposed protocol should have provisions
for the mailing-list corner case; otherwise, this corner case will become
the path of least resistance for spam to get through. Just as an electrical
current, spam will then follow this path - perhaps not immediately, but
eventually, when it is one of the last opportunities left open.

'A solution is only as strong as it's weakest link'

Radu.

PS. I had the pleasure to go through your C/R procedure, and I appreciate
the ease of use from my end. How many mailboxes does your software protect?

---

From: "Christopher Lin" <[email-masked]>
Date: Sat, 27 Mar 2004 13:15:00 -0500 (EST)

Hello,
I am currently looking at the draft document and would like to keep it
'live'. I'm implementing a C/R javamail program and making this a standard
could help alot.

standard?
>> 2. About the contents: If a spammer would add headers to his message to
make it look like a mailing list, this message would then not be
subject
>> to

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 27 Mar 2004 21:57:54 -0500

There hasn't been much interest in the last six months about this from 
anyone in the C/R community. We are inclined to discontinue working on 
this draft due to lack of feedback.

Yakov

Christopher Lin wrote:
>>>1. About the challenge-response draft document: Are your intentions to
> 
> make
> 
>>>the other provisions of the draft? Is there a separate draft/RFC to
> 
> deal
>

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 27 Mar 2004 21:56:57 -0500

We got very little feedback on this draft. If there is a desire from the 
community to work on this, than we will gladly continue editing and 
writing the draft. Otherwise, there is no point.

Yakov

---

From: "Eric Dean" <[email-masked]>
Date: Mon, 29 Mar 2004 21:22:09 -0500

It's very simple to implement...it's also nice for loop avoidance.  Just
add the headers...don't expect any back 8-)

> Behalf Of Christopher Lin
> Sent: Saturday, March 27, 2004 1:15 PM
> To: [email-masked]
> Subject: Re: [Asrg] asrg-cri - spam to mailing lists ?
> 
> 
> Hello,
> I am currently looking at the draft document and would like 
> to keep it 'live'. I'm implementing a C/R javamail program 
> and making this a standard could help alot.
> 
> > Radu Hociung wrote:
> >> Hello all,
> >> I've been following the group for a while, and I can't find the 
> >> answer I'm looking for: 1. About the challenge-response draft 
> >> document: Are your intentions to
> make
> >> 2. About the contents: If a spammer would add headers to 
> his message 
> >> to
> make it look like a mailing list, this message would then not 
> be subject
> >> to
> >> with the mailing list/CR combination, or do you intend to address 
> >> this in some way?
> >
> were planning on dealing with this in the future, IF 
> sufficient interest would be shown in the idea. So far no 
> interest was shown and as a matter of fact, the document is 
> about to expire.
> >
> > Yakov
> >
> >

---

From: "Eric Dean" <[email-masked]>
Date: Mon, 29 Mar 2004 21:23:53 -0500

If someone adds some challenge suppression Exempt headers, this does not
mean that the email simply goes through.  In many cases, it's simply
quarantined.  There is no advantage to adding an exempt..if anything, it
only subjects the email to more scrutiny.

> Sent: Thursday, March 25, 2004 11:15 AM
> In that case, I really think the proposed protocol should 
> have provisions for the mailing-list corner case; otherwise, 
> this corner case will become the path of least resistance for 
> spam to get through. Just as an electrical current, spam will 
> then follow this path - perhaps not immediately, but 
> PS. I had the pleasure to go through your C/R procedure, and 
> I appreciate the ease of use from my end. How many mailboxes 
> does your software protect?
> 
> 
> >protocol and the actions that are taken based upon specific messages 
> >are up to individuals.
> >
> >> >> message to make it look like a mailing list, this message would 
> >> >> then not be subject to the other provisions of the 
> draft? Is there 
> >> >> a separate draft/RFC to deal with the mailing list/CR 
> combination, 
> >> >> or do you intend to address this in some way?
> 
>