Subject: Re: Denial of Service by Spamware?

From: Vernon Schryver <[email-masked]>
Date: Fri, 29 Dec 2000 12:58:16 -0700 (MST)

> From: Ted Gavin <[email-masked]>

> ...
> First, I'm no Microsoft advocate. I was a mail administrator for some
> number of years in the course of which, I had to deal with Microsoft
> messaging products. 

As such, you should look around at other systems and perhaps even
read what people have repeatedly said here to discover that your
the problem statement is entirely off the mark.

> Those persons who are responsible for managing Microsoft Exchange
> implementations should know that Out-Of-Office responses, as well as
> anti-virus application auto-notifications can be given permission to
> send to the Internet, just as they can be DENIED permission to send to
> the Internet. ...

What is that "send to the Internet" business?  The vacation message
problem has nothing to do with "sending to the Internet", but with
not doing as has been said many times here.

Those who have ignored the repeated descriptions of the bug here could
look for the problem elsewhere.  They could start at
http://www.FreeBSD.org/cgi/man.cgi and then
http://www.FreeBSD.org/cgi/man.cgi?query=vacation&apropos=0&sektion=0&manpath=FreeBSD+4.2-RELEASE&format=html

and which contains

   No message will be sent unless login (or an alias supplied
   using the -a option) is part  of  either  the  ``To:''  or
   ``Cc:''   headers   of   the   mail. 

> The fault is not in the software. The fault is with the users and the
> administrators.

You are wrong.  The fault is first in the software for not doing
what has been repeatedly described here.  The fault is with the
users and administrators second for unthinkingly accepting a silly
description of the problem and doing as people in Redmond do and
not paying attention to anything that didn't originate in Redmond.

> ...
> I agree. Not everyone's software does it, but not everyone's software
> gives people an equal level of administrative control. If you
> implement Exchange, you're not looking for the complexity or
> specificity that sendmail or some other product offer you. You're
> basically purchasing McMail. You're looking for whatever benefit you
> feel that Exchange provides. At that point, what any other products do
> becomes irrelevant. 

Again, for the umpteenth time, this bug has nothing to do with sendmail
or any MTA, as most people distiguish MTA's from MUA's.  From what some
Microsoft advocates have said, that is even the case with this Microsoft
bug, that the out-of-office abuse system is outside the Exchange MTA.

> ...
> So you are essentially stating that persons who work for companies
> that use Microsoft Exchange Server are no longer welcome in IETF
> participation unless they use a mailer and get another account of
> their own? If so, just come out and say it.

I'm saying that people who are too lazy or witless to pick software that
does not cause them to make pests of themselves have no place trying to
develop network protocols.  Those who are cannot be bothered to pay
attention to years of repeated descriptions of a serious problem in their
software but instead merely repeat the party line of their chosen vendor
are worse than useless in any design effort, including the IETF's.

>                                             So, since Exchange users
> will now have to pay for another mail account, why not just let them
> use Exchange, but charge them a membership fee and use the cost to
> subsidize a moderator? 

That is more of the all too common IETF-as-a-social-club-and-tutorial
nonsense.  

> Your point, while making it nice and convenient for everyone, is
> directly contrary to the notion that the internet is for everybody.

The Internet is not for everybody, but only for those who pay their own
freight.  Besides, I explicitly said that this bugware should be banned
from the Internet but only banned from subscribing to IETF lists.  The
IETF is not the Internet.

> Inasmuch as IETF exists under the ISOC umbrella,

That is quite wrong.

>                                                  and since there are
> both valid and valued contributors to IETF who use Exchange (I was
> once one, thankyouverymuch), perhaps there's a more palatable way to
> do this.

The notion of "*valid* contributors to the IETF" sets the hackles of anyone
who thinks about it.   "Valued contributors" are something else, although
that has related dubious aspects.  Those who claim to be valued IETF
contributors tend to be more valued in their own eyes than anyone else's.

> >Is the vacation feature of the package separate from the
> >main thing?--perhaps but that's irrelevant.  
>
> I disagree. I think it is entirely relevant It's only different
> because it's a client-driven feature as opposed to a server-driven
> feature. ...

Nonsense.  How some marketeers decide to package things does force
the world to accept abuse.  "Tying" and "packaging" are forces of
nature only for consumers who let any single vendor's marketers do
their thinking for them.

Vernon Schryver    [email-masked]

---

From: "Christopher Ambler" <[email-masked]>
Date: Fri, 29 Dec 2000 14:02:03 -0800

> develop network protocols.  

I'm sorry, but I take offense at this. I am neither lazy nor witless, and I
chose Exchange. I configured it around its obvious flaws, and it does
not exhibit the behaviour that is causing such strife around here.

Is Exchange broken? Undoubtedly so. Is there a way that a clueful
user can overcome the break? Absolutely. Should the software be
"banned?" Of course not. If anything, unsubscribe those users who
can't take the trouble to ensure that their system, *regardless of the
software used,* works properly.

Christopher

---

From: Tripp Lilley <[email-masked]>
Date: Sat, 30 Dec 2000 02:08:33 +0000 (/etc/localtime)

> software used,* works properly.

And back that up with a note "from the IETF" to the developers of the
software, describing its standards avoidance in exhaustive detail. Yes,
we've hashed over those details here on the list, but there's no guarantee
that the developers of any particular offensive code will be on this list
(which, perhaps, should say something, but...)

For the record, the offenders I've noted in response to my posts have
included Novell Groupwise, Lotus Notes, "Internet Mail Service", and
something I couldn't readily identify because it seemed to lack an
X-Mailer: or other identifying header. I'm pretty certain Notes comes
configured for braindamage "out of the box", though, because of all of the
vacation spam I've received over the years from Interop suits when posting
to those lists. Which would suggest either that there are more clueful
Notes admins running IETF list members' sites, or that there are fewer
IETFers behind Notes scramblers^H^H^Hgateways.

-- 
   Joy-Loving * Tripp Lilley  *  http://stargate.eheart.sg505.net/~tlilley/
------------------------------------------------------------------------------
   "There were other lonely singers / in a world turned deaf and blind
    Who were crucified for what they tried to show.
    Their voices have been scattered by the swirling winds of time,
    'Cause the truth remains that no one wants to know."

   - Kris Kristofferson, "To Beat the Devil"