Subject: Re: You Might Be An Anti-Spam Kook If ...

From: Shelby Moore <[email-masked]>
Date: Mon, 08 Sep 2003 21:59:12 +0800

>Ah. The ever popular "IETFers-are-jealous-because-I'm-sexy" argument.

No, the argyment to stay focused on the serious engineering debate, such as in link below.

> when you are told by _several_different_people_ that this idea 
>has flaws.

Which have all been resolutely refuted and defeated ad nauseum by me.

And to make that clear, I have written a summary for you:

http://www1.ietf.org/mail-archive/ietf/Current/msg22112.html

Shelby Moore
http://AntiViotic.com

---

From: Shelby Moore <[email-masked]>
Date: Fri, 12 Sep 2003 06:34:53 +0800

>> Iljitsch van Beijnum wrote:
>> declaring the spam problem unsolvable. I don't think it's a good idea 
>> to lend credibility to this sentiment by publishing it as an RFC. 
>> 
>> How hard is it to agree that: 
>> 
>> a) there will always be (some) spam 
>> b) there is no need for it to be 50% of all mail 

> Vernon Schryver responded:
>That last sentiment is on my list.
>
>There are several currently available, independent sets of mechanisms
> that will keep more than 90% of all spam out of your mailbox with fewer
> than 0.1% false positives. If your mailbox receives on average more than
> 1 spam/day and you care, then fire your current ISP and hire one that
> offers reasonable spam defenses. If you care to invest your own time and
> effort maintaining filters or if you can tolerate more than 0.1% false
positives,
> your mailbox can be practically spam free.

Consider my response a new thread, "Why all existing anti-spam will fail
miserably or are otherwise indequate".

Or consider this response, "Exposing the security holes in all existing
anti-spam techniques", similar to the benefits of exposing the security holes
in operating systems before they are exploited.  There is no sense in relying
on something and making an ever increasing investment in that thing, if it is
going to fail miserably at some point and force you to start over.

Vernon, misses some *very* important details in his *simplistic* analysis
above, which I am confident after all of you read the following, you will agree
could not be left as an unchallenged statement *pretending* to be factual.

1. The DCC (Vernon's business) and all current practical anti-spam which can
generate the 90% + < 0.1% that Vernon claims, rely heavily on whitelisting,
which is both inherently subvertable and more importantly which has a great
cost to (usually not transportable) investment in maintenance, which may in
many cases outweigh the *current* cost of spam:

Shttp://www.ietf.org/proceedings/03mar/slides/asrg-1/sld12.htm

2. Not all people can use those existing anti-spam tools.  For example, I am
capable of using BrightMail on my Earthlink account but not on my hosted
accounts.  In order words, those existing tools don't scale every where.

3. And here is the kicker.  ALL existing anti-spam methods, can be (and thus
will eventually be) easily subverted.  This is already in public domain else
where.  All someone need do is create a virus which both spreads sometimes via
email and the rest of time sends large quantities of highly randomized spam. 
The seed would need to be truely random (e.g. cpu clock modulo milliseconds)
and randomize all headers (To, From, Subject, etc) and content, using lookup
tables of common domains and words.  Vernon's DCC, Paul Graham's Bayesian
filters, reply opt-in whitelisting, etc.. would all fail miserably. 
Additionally imagine all the bounced traffic (from randomized address) and
especially the case where two reply opt-in whitelisting entities get caught in
infinite loop (randomized From/ Reply-To addresses).  Also this would probably
overload the DCC servers with too many unique flooded checksums.  Some "script
kiddie" could become famous by turning all anti-spam from 90% in 1%
effectiveness in days, not to mention probably overloading internet email to
the point where no one could find their legitimate email.

If #3 happens, those of you here at the IETF who attempted to ridule me
(unsuccessfully obviously), will be realizing that my warnings of dire
architectual problem are real.

Lastly I have done the full background search at ASRG (IRTF), and I did not
find prior art for either the proposal I made to legitimize bulk email by
moving it to "pull", nor the prior art for our soon to be patent-pending
anti-spam algorithm.

The closest prior art I found was "spam is any bulk email from someone you
don't know" essay, and "time-domain analysis" idea (with no details).  I am
indeed working on novel anti-spam, and I do not appreciate the unprofessional
suggestion (borderline libel) otherwise.

If any one would like the full set of links to my research ("literature
review") at the ASRG, email me and I will send them to you privately.

This is the last I have to say on this matter in public.  I am extremely
confident in the expertise of my assertions.  The rest will be said with my
actions and other naturally occurring events.

Shelby Moore
http://AntiViotic.com

---

From: Shelby Moore <[email-masked]>
Date: Fri, 12 Sep 2003 07:15:03 +0800

positives,

http://www.ietf.org/proceedings/03mar/slides/asrg-1/sld12.htm

3. And here is the kicker.  ALL existing anti-spam methods, can be (and thus
will eventually be) easily subverted.  This is already in public domain else
where.  All someone need do is create a virus which both spreads sometimes via
email and the rest of time sends large quantities of highly randomized spam. 
The seed would need to be truely random (e.g. cpu clock modulo milliseconds)
and randomize all headers (To, From, Subject, etc) and content, using lookup
tables of common domains, and normal words people use in email.  Vernon's DCC,
Paul Graham's Bayesian filters, reply opt-in whitelisting, etc.. would all fail
miserably.  Additionally imagine all the bounced traffic (from randomized
address) and especially the case where two reply opt-in whitelisting entities
get caught in infinite loop (randomized From/ Reply-To addresses).  Also this
would probably overload the DCC servers with too many unique flooded
checksums.  Some "script kiddie" could become famous by turning all anti-spam
from 90% in 1% effectiveness in days, not to mention probably overloading
internet email to the point where no one could find their legitimate email.

Shelby Moore
http://AntiViotic.com

---

From: Shelby Moore <[email-masked]>
Date: Fri, 12 Sep 2003 07:16:29 +0800

positives,

Shelby Moore
http://AntiViotic.com

---

From: [email-masked]
Date: Fri, 12 Sep 2003 10:47:57 -0400

> moving it to "pull", nor the prior art for our soon to be patent-pending

----
Q: Okay, what's the idea?
A: Add something RSS-like to email clients, where the client
occasionally (and infrequently) polls "subscribed" sites for new content
and drops any new content into the normal mail stream (so that you could
filter it into folders).  

For example, suppose I want to subscribe to the Floss Recycling
newsletter.  The Floss Recycling Web site gives instructions on the
subscription address and when the newsletter comes out (e.g. "Mondays at
3 PM PST).  I set up my email client to poll every Monday at 4 AM and to
drop the newsletter into my FlossRecycling folder.
----

(From the previously cited  posting to ASRG by Kaitlin Sherwood).  The only
difference I can see from what she proposes and what you propose is that she
says "something RSS-like" and you said "POP".  Elsewhere in the same posting,
she points out it doesn't need to be RSS:

----
Q: Is RSS your clear and obvious choice for this?
A: Absolutely not.  My "expertise" in RSS is the product of only a few
hours wandering around the Web looking at various Web sites.  I feel
like RSS is off in this parallel universe that I really don't know
anything about.

In particular, it was not obvious to me how the RSS client would figure
out what was new since last checked and what was not.  
----

OK.. So *maybe* you get partial credit for the idea that UIDL can be used
to provide a capability that RSS didn't provide.

----
Q: So how on earth would this reduce spam?
A: One of the biggest problems that content analyzers (e.g.
SpamAssassin, spambayes) have is that legitimate commercial newsletters
can look an awful lot like spam.  If we can reroute all of the legit
mass mailers to this RSS-esque scheme, then the content analyzers can be
much more aggressive.
----

So she's even got the "If we move it all to this new scheme, we can attack anything
left as spam" aspect.

She even points out a few things you haven't mentioned (such as the "proof of delivery"
aspect of a "pull" system).

So other than "you can use UIDL", what *really new* concepts are in *your* proposal?