Subject: [Asrg] Re: SPF abused by spammers

From: Frank Ellermann <[email-masked]>
Date: Fri, 10 Sep 2004 16:05:47 +0200

Markus Stumpf wrote:

> Microsoft claims IPR (which they did even before the group
> was chartered, btw, but everyone ignored it).

Not really,  May 20: draft-atkinson-callerid-00 published.
May 21: ASRG co-chair resigns.  May 22: IPR complaint filed.

> We have a second trump card, we play ... SPF. Tataaaa.

Sure, there's nothing wrong with spf2.0/mailfrom as long as
you don't confuse it with the FUSSP.  In theory spf2.0/pra
could also make sense if they fix their "patented" algorithm
to read four mail headers for some common cases.

> We still don't have "the anti spam solution", but hey,
> who cares or realizes this.

I care.  Back to zero bounces / out-of-office / vacation /
challenges / broken NDRs / Symantec announcing its ignorance
to the e-mail world at large / etc. per day as it was in 2003.

Instead of 1000 useless mails caused by forgeries per day.
You need a modem account and a catch-all vanity host to feel
the difference.

> everyone always says "this is the way to go", so nobody
> asks where the way will really lead to.

Again not really.  I still like your MTAMARK idea, and it's
also very interesting to watch SURBL.  And even C/R systems
could work in combination with a spf2.0/mailfrom PASS.

                          Bye, Frank

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 10 Sep 2004 17:14:02 +0200

Hoi Frank,

> May 21: ASRG co-chair resigns.  May 22: IPR complaint filed.

I have a PDF document from Microsoft which is named
"callerid_license.pdf" and is dated "Published: February 20, 2004".
It starts with:
------------------------------------------------------------------------
    Caller ID for E-mail Implementation License

    This document is intended to expand upon the rights that Microsoft
    grants to certain individuals and organizations interested in developing
    and implementing software programs having one or more aspects conformant
    to the Caller ID for E-mail Specification (the "Specification") by
    providing a patent license to the Specification. Copies of the
    technical specifications for the Caller ID for E-mail Specification,
    which include an associated copyright notice and license, can be found at
    http://www.microsoft.com/mscorp/twc/privacy/spam_callerID.mspx.

    Please read this entire document carefully to understand your rights.

    Patent License
    Microsoft believes that it has patent rights (patent(s) and/or pending
    applications(s)) that are necessary for you to license in order to
    make, sell, or distribute software programs that comply with one or
    more aspects of the Caller ID for E-mail Specification.
    [ ... ]
------------------------------------------------------------------------
So it was clear from the beginning that every derivate work that relates
to Caller ID will have an IPR problem and that Microsoft will file a
complaint. Many people stated it, it should be in the archives, but
it was deliberately ignored.

> to read four mail headers for some common cases.

SPF will not solve "the spam problem" and it will not solve "the
phishing problem". It will *try* to solve the problem with domain
forgery and while trying it breaks the whole existing Internet mail
infrastructure by requiring something like half baked SRS.

> to the e-mail world at large / etc. per day as it was in 2003.

In which way does SPF protect you from
   out-of-office / vacation / challenges

Maybe I should have been clearer and write:
   > everyone always says "this is the way to go", so journalists don't
   > ask where the way will really lead to.
because they still are under the assumption "MARID will solve the spam
problem". I fully understand they must be disappointed to read the
CipherTrust report.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: Frank Ellermann <[email-masked]>
Date: Sun, 12 Sep 2004 21:38:52 +0200

> "callerid_license.pdf" and is dated "Published:

Yes, they forgot to mention this in draft-atkinson-callerid-00.
This forced me to fast read some RfCs about IETF procedures if
nothing else, not a complete waste of time.  An IPR statement
was published about one week later (IIRC).

Some weeks later MARID decided that XML-over-DNS isn't very
convincing, and now MARID finally found that the "PRA" stuff
(algorithm and patent) is also rather dubious.

> It will *try* to solve the problem with domain forgery and
> while trying it breaks the whole existing Internet mail

 From my POV that's not the case.  Mail is either on my side
(MUA to MSA or similar / more elaborated structures)  or it's
on the side of the recipient (MX / MDA).  That's covered by
"my" sender policy, don't accept any mail claiming to be sent
from me unless it's sent by one of the IPs in my sender policy.

Now if the recipient wishes to forward my mail he's free to
do so (I'd recommend RfC 1149 ;-), but he must not abuse "my"
MAIL FROM.  There are many other ways to forward mail.

> In which way does SPF protect you from out-of-office /
> vacation / challenges

The spammer forging @xyzzy addresses stopped to do so.  Now of
course he failed to inform me _why_ he stopped. and he also
failed to inform me why he started this abuse, therefore I can
only guess:  Maybe he replaces all abused domains after almost
precisely six months.  Or he's out of business.  Or he uses SA
for his quality control, and abusing xyzzy addresses FAILed for
SA 3.0.  Whatever he did, no more vacation / OOO / bounces /
challenges / etc. mails for me.  But more spam, as expected.

                        Bye, Frank
-- 
I think we've seen that forcing spammers to send more spam
hasn't been an effective way to make them stop sending spam.
[John L. <http://archive.iecc.com/article/spamtools/20030521001>]