Subject: spoofing email addresses

From: "Christian de Larrinaga" <[email-masked]>
Date: Mon, 24 May 2004 10:18:28 +0100

Since Thursday (last) I've been receiving hundreds of bounces from spam
filters and mail servers for email messages I've not sent at
[email-masked]. I can see from those bounces where the header info of
the orginal message is included that somebody has been using my address to
disguise the origin of their spam.

I'm hoping that spam filters will detect the inconsistent header information
and not blacklist me at [email-masked] but I'm not hopeful. If you want
to get email from me you might want to check. I intend to continue to use
this address. Incidentally does anybody run a retribution service?

Christian de Larrinaga

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: [email-masked]
Date: Mon, 24 May 2004 13:49:02 -0400

On Mon, 24 May 2004 10:18:28 BST, Christian de Larrinaga <[email-masked]>  said:

> and not blacklist me at [email-masked] but I'm not hopeful.

In fact, there isn't any sane way to detect "inconsistent" header information
without external hints - this is the reason why there's the SPF proposal, the
Yahoo domain-keys proposal, and Microsoft's proposal.  (Contemplate
the headers on this piece of e-mail for a nonce, and ask yourself if they're
consistent or not.  Then consider the fact that I've on at least one occasion
posted to this list from this same laptop, but at the time I was behind a
NAT'ed firewall in California....)

---

From: "Randy Presuhn" <[email-masked]>
Date: Mon, 24 May 2004 13:01:51 -0700

Hi -

> From: "Christian de Larrinaga" <[email-masked]>
> To: <[email-masked]>
> Sent: Monday, May 24, 2004 2:18 AM
> Subject: spoofing email addresses
>

> disguise the origin of their spam.
...

Welcome to the club.  In "joe-job" spam (viral or otherwise)
I think I've seen the email addresses of just about everone I
know from the IETF.

Randy

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 24 May 2004 16:55:45 -0400

On May 24, 2004, at 5:18 AM, Christian de Larrinaga wrote:

> Incidentally does anybody run a retribution service?

Boy, do I hope this question is a joke.  But if I were running some of 
the blacklisting services, I would worry that someone might get serious 
about revenge.  If I were a less placid person, I hate to think what I 
might have done after being unfairly blacklisted by RoadRunner for 6 
months.  (As it is, even after a year, I still find some juvenile 
satisfaction in repeatedly mentioning them by name in this context.  
But the desire for revenge could easily get much nastier.)   -- 
Nathaniel

---

From: Dave Crocker <[email-masked]>
Date: Mon, 24 May 2004 16:11:48 -0700

Nathaniel,

NB> Boy, do I hope this question is a joke.  But if I were running some of 
NB> the blacklisting services, I would worry that someone might get serious 
NB> about revenge.

already happens, mostly through DDOS attacks.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Andrew Newton <[email-masked]>
Date: Tue, 25 May 2004 19:17:31 -0400

On May 24, 2004, at 1:49 PM, [email-masked] wrote:
> Yahoo domain-keys proposal, and Microsoft's proposal.

And MARID.

-andy

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 26 May 2004 15:00:00 -0600 (MDT)

> From: Andrew Newton <[email-masked]>

> > Yahoo domain-keys proposal, and Microsoft's proposal.

I don't see any of those proposals and their competitors as sane.
Some of them, such as SPF, do not even meet their own design goals
as stated informally by their advocates.  Others such as domain-keys
do not seem to do anything that is not already done by SMTP-TLS, despite
the goals in the I-D that seem to be closer to S/MIME.  None of them
have much to do with spam, but only with a currently popular mode of
attack used by spammers.  None have any hope of affecting even that
particular attack mode for years, because none can have any significant
effect until deployed on most SMTP clients.  Many seem to be based on
insufficient familiarity with the nature of SMTP (e.g. SPF's incredible
source-routing scheme) and the urge to Do Something Now regardless of
actual results.

Vernon Schryver    [email-masked]

---

From: James Denness <[email-masked]>
Date: Wed, 26 May 2004 18:24:32 -0400 (EDT)

Hello,

I am currently involved in a project to create an internet-draft for a
domain/key based system allowing mail domains to be validated using rsa
keys, distributed using the DNS system, with minimal modification to
existing infrastructure. Does a specification for such a system already
exist? I have many ideas for extentions to the existing SMTP protocol, as
well as plans for a derivative protocol incorporating this key-based
system as a more secure and verifiable method of exchanging mail. If
anyone is interested, I would appreciate being contacted off-list to
discuss the possible formation of a working group to discuss such ideas.

Regards,
James Denness

On Wed, 26 May 2004, Vernon Schryver wrote:

> Date: Wed, 26 May 2004 15:00:00 -0600 (MDT)
> From: Vernon Schryver <[email-masked]>
> To: [email-masked]
> Subject: Re: spoofing email addresses
>

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 26 May 2004 17:04:52 -0600 (MDT)

> From: James Denness 

> discuss the possible formation of a working group to discuss such ideas.

what about http://ietf.org/html.charters/marid-charter.html ?

It might be interesting to contact the author of
draft-delany-domainkeys-base-00.txt
or the authors of the at least half a dozen other proposals to use
public keys or other mechanisms along with the domain name system to
authenticate mail senders.

My rather negative view of the area can be inferred from
http://www.rhyolite.com/anti-spam/you-might-be.html

---

From: Paul Vixie <[email-masked]>
Date: 26 May 2004 22:00:26 +0000

> > In fact, there isn't any sane way to detect "inconsistent" header
> > information without external hints - this is the reason why there's the
> > SPF proposal, the Yahoo domain-keys proposal, and Microsoft's proposal.
> 
> And MARID.

and don't forget <HREF="http://sa.vix.com/~vixie/mailfrom.txt">MAIL-FROM</A>.
-- 
Paul Vixie

---

From: [email-masked]
Date: Thu, 27 May 2004 10:56:36 -0400

> I don't see any of those proposals and their competitors as sane.

Oh, I wasn't addressing whether the proposals were workable, merely listing
proposals motivated by the fact that verifying the legitimacy of a sending
machine is difficult.

As you correctly note below, the proposals aren't even a workable solution to
the real problem (I've yet to see a proposal that works if the spammers start
utilizing zombie machines that snarf the already-stored credentials of the user
to send mail)....

> source-routing scheme) and the urge to Do Something Now regardless of

Do you realize how *difficult* it is to create a workable anti-spam scheme that
doesn't run afoul of at least one line item of your "you-might-be" checklist? :)
(Thanks for writing it, BTW - I've decided it's the canonical answer to the
question "Why is stopping spam so hard?")

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 27 May 2004 18:23:17 +0200

On 27-mei-04, at 16:56, [email-masked] wrote:

> the proposals aren't even a workable solution to

It amazes me how many people are eager to declare defeat on the spam 
problem.

Regardless of anything else, having authenticated mail allows 
whitelisting. If credentials are compromised they're simply removed 
from the whitelist. This should work well for all non-huge whitelists.

There is also the possibility of blacklisting known bad credentials. 
Yes, spammers can steal credentials, but this is several orders of 
magnitude more difficult than just generating a random from address as 
can be done today. The question is whether spammers can obtain new 
credentials (stolen or otherwise) faster than others can blacklist 
them. For user-based credentials this could very well be the case 
(although I'm not conceding to that), but for MTA-based credentials it 
should be possible to rate limit the obtaining of a new identity such 
that spammers can no longer reach critical mass. (I.e., wait a week 
before you can use an MTA with a certain address, then spam an hour 
before you're blacklisted reduces the amount of spam that can be sent 
from an address by a factor 169.)

"The people who claim that something can't be done shouldn't get in the 
way of the people doing it."

---

From: "Mr. James W. Laferriere" <[email-masked]>
Date: Thu, 27 May 2004 10:47:04 -0600 (MDT)

Hello Paul ,

> and don't forget <HREF="http://sa.vix.com/~vixie/mailfrom.txt">MAIL-FROM</A>.
	I do not see a draft in the ietf process anyplace .  Was this
	ever submitted ?  I do notice that several of the other
	proposal's make mention of this work ,  But in none of them do
	they mention it as a draft or other ietf work .  Any plans to
	submit it as a draft .  Tia ,  JimL
-- 
       +------------------------------------------------------------------+
       | James   W.   Laferriere | System    Techniques | Give me VMS     |
       | Network        Engineer | 3542 Broken Yoke Dr. |  Give me Linux  |
       | [email-masked] | Billings , MT. 59105 |   only  on  AXP |
       +------------------------------------------------------------------+

---

From: [email-masked]
Date: Thu, 27 May 2004 13:27:19 -0400

> There is also the possibility of blacklisting known bad credentials.

Anybody who's had to get themselves out of 3,000 private blacklists, and
anybody who's had to fight with places that were blackholing the 69/8 address
space, knows that private blacklists are a bad idea.

And nobody seems to want to trust anybody to run a public blacklist to
everybody's satisfaction.  Consider that we as an industry haven't even figured
out how to pick an organization to supervise the DNS to everybody's
satisfaction.  Think about ICANN and "how many TLD's should there be?" and
Verisign's "Site Finder".  Add in Matt Blaze's adage about "A CA can protect
you from anybody they're not accepting money from", and the various
jurisdictional issues.  Then ask yourself if we're in any position to let
*anybody* decide "You can't send/receive email".

(Notice, I haven't said it's impossible - I said that we as a community don't
know how to do it.  There's a big and very important distinction there...)

> from an address by a factor 169.)

There's two problems with this:

1) Waiting a week probably isn't a sellable to the user community.  If you
don't believe me, consider how fast people bailed their domain registrations
away from a registrar that had a reputation of taking a week to do anything,
and going to registrars that promised setup times measured in hours.

2) The assumption that you can catch, verify, and deploy a blacklist for a
spammer in an hour is highly suspect, for several reasons:

(a) it means that the *effective* TTL of a DNS MX entry is much lower than an
hour (as everybody will have to re-fetch at least 2-3 times an hour to verify
they're not blacklisted - a once-an-hour update means that on the *average*
there will be a 30 minute delay, and up to 59 minutes at worst case).  Notice
how few software products that use X.509 certs actually implement CRL's
*correctly*...

(b) "Under an hour" deployment almost certainly implies an automated process to
blacklist..  That has "denial of service" written all over it....

Again, I haven't said it's *impossible* - merely that we've not seen a concrete
proposal that actually has the right scaling and uptake characteristics...

> way of the people doing it."

I didn't say it *cant* be done.  I said there were known problems that any
successful solution would have to address.

Solving the spam problem is like solving global warming - neither is a problem
that demonstrably *cant* be done, but both are problems that we don't know how
to solve and which don't have anybody actively solving the problem in a production
mode (the fact that both are still perceived as a problem is proof that neither is
actually being solved).

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 27 May 2004 12:51:49 -0600 (MDT)

> From: [email-masked]

> successful solution would have to address.

Another response is to point out that all of the sender validating
systems are today only proposals that can be seen as getting in the
way of effective tactics.  The talkers trying to get in the way of the
doers are, as usual, those who endless prescribe spam solutions that
they themselves have not thought out, not to mention documented, tested,
or deployed.

The vast majority of the spam that sender validating systems might
block after they have been installed in most SMTP clients 5 or 10 years
from now is rejected today at any organization that really cares about
spam using any of various tactics including DNS blacklists (e.g. the
CBL or the so called "dynamic IP" lists) and greylisting.
Essentially all of the spam that any sender validating system might
someday block after large outfits like Comcast have installed validating
code on their SMTP clients and servers would be blocked today at the
source if those same outfits would block port 25 for all types of IP
service except the one that draft-klensin-ip-service-terms-01.txt calls
"Full Internet Connectivity."  That is because current spam that
would be blocked by sender validating comes "trojan proxies."

The current state of the art in spam defenses reject more than 99%
of spam with less than 1% false positives (or variations of those
numbers such as 95% and 0.1%).  No one who is actually do anything
about spam is content with those numbers or confident that new
tactics will not be needed, but please don't tell the experts who
don't know the difference betwee an SMTP rejection and a bounce, lest
they be encouraged to tell us some more what we really should be doing.

As usual, the usual suspects who might someday get around to reading
an RFC, any RFC, tell us that The Final Ultimate Solution to the Spam
Problem is just around the corner.  Their Finual Ultimate Solution is
waiting for the obstructionists to get out of the way of those who
will realsoonnow write the FUSSP RFC.  Of course, the usual suspects
can't be bothered to come down from Mt. Olympus to write a I-D or
learn the relationship between I-Ds and RFCs.  They don't care about
the differences among documenting, testing, or deploying, or the chasm
between practice and sidewalk superintendent theory.

Probably the best response is to send people to the MADID mailing list.
I've often said that the IETF is well served by working groups that do
no more than absorb the energies of standards committee goers.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 27 May 2004 22:57:34 +0200

> CBL or the so called "dynamic IP" lists) and greylisting.

I'd say "back this up" but then we're once again having one of these 
unproductive spam discussions. Why don't we all do this on our personal 
favorite anti-spam list and revist the issue here only when there is a 
pertinent draft in last call?

One last remark:

> block port 25

This is evil for several reasons:

1. blocking ports reduces the functionality of the internet
2. doing work per-packet rather than per-session is inefficient 
(especially considering that only a small fraction of all packets is 
email to begin with)
3. requiring others to clean up their act rather than do something 
yourself is ineffective

---

From: Paul Vixie <[email-masked]>
Date: Thu, 27 May 2004 21:17:14 +0000

> > ... <HREF="http://sa.vix.com/~vixie/mailfrom.txt">MAIL-FROM</A>.
> 
> 	they mention it as a draft or other ietf work .  

there was no working group where it was appropriate at the time it was
written.  i've sent it to every one of the dozen people who have asked
me to review some similar, and usually ill considered thing.  i've also
sent it to several spam-related and dns-related mailing lists, including
this one (ietf@).

>       Any plans to submit it as a draft .  Tia ,  JimL

MARID is basically a layer 9 exercise, uninterested in engineering as
such.  it was formed to merge two ill considered ideas, one from yahoo
and one from microsoft, in a way that would cause either no loss of face,
or equal loss of face, for those two parties.  the people who submit
their own ideas to it are wasting their time.

---

From: John Stracke <[email-masked]>
Date: Fri, 28 May 2004 09:06:50 -0400

Iljitsch van Beijnum wrote:

>> (I've yet to see a proposal that works if the spammers start
> The question is whether spammers can obtain new credentials (stolen or 
> otherwise) faster than others can blacklist them.

And, if you had actually read the message you replied to, you would have 
realized that the answer is yes.  Send out a worm that makes N zombies, 
have each zombie send one message under the local user's credentials, 
and none of them will get blacklisted.

-- 
/===============================================================\
|John Stracke      [email-masked]                        |
|Principal Engineer|http://www.centive.com                      |
|Centive           |My opinions are my own.                     |
|===============================================================|
|The light at the end of the tunnel is a terawatt laser cannon. |
\===============================================================/

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 28 May 2004 08:24:40 -0600 (MDT)

> From: John Stracke <[email-masked]>

> and none of them will get blacklisted.

Here's a defense for that scenario:

  1. block port 25 to external IP addresses for all of your customers
    except those with what draft-klensin-ip-service-terms-01.txt calls
    Full Internet Connectivity.

  2. Do not sell Full Internet Connectivity to anyone running Microsoft
    software exposed to the Internet.  Possibly relax this with a $2000
    bond forfeited along with connectivity at the first propagation
    of a worm or other spam.

  3. The effects of #1 and #2 include forcing all mail from the usual
    suspects through your own mail systems so that you can do as the
    credit card companies do.  Track SMTP envelope Mail_To values or
    other characteristics for each customer.  When you see a change,
    contact the customer by voice to check.

In practice, you could probably get by with detecting changes in mail
volumes, since a spam spew of 1 message/zombie is at least 10 and
probably 1000 times too low to be practical for high volume spammers.
As far as I can tell, the typical user sends only about a dozen
messages/day.

Of course, the fatal problem with this spam defense is that it is not
based on other people doing the work and paying the costs.  It is not
a coincidence that as far as I can tell Yahoo continues to be the most
important U.S. host for Nigerian 419 spammers or that Windows XP
practically requires or at least strongly encourages individual users
to run their browsers and MUAs as "administrator."  It is not a
coincidence that sender validating systems including those Yahoo and
Microsoft are based on the rest of the Internet doing most of the work.

The howls from the Special People who feel that they are entitled  to
Full Internet Connectivity at prices and terms they find comfortable
(and about the per capita income in large parts of the world) are also
related to the fundamental cause of all spam.  There would be no spam
problem including worms if every ISP would look after its own problems
by terminating all spammers including customers who let their machines
be "owned" or if all users were willing to pull their own weight instead
of expecting something for nothing.

---

From: "william(at)elan.net" <[email-masked]>
Date: Thu, 27 May 2004 19:56:56 -0700 (PDT)

Paul,

  MARID was formed to merge Microsoft Caller-ID with SPF and so far has
been successfully used by Microsoft to bully us to submit to their own
proposal or else ... There are better ways to implement mail-from (i.e.
as from Paul's draft which is basicly still the basis for MARID) which 
would not require reusing TXT records, nor is it totally clear that
Mail-from is what we actually need to protect, it is being done under 
pretese of anti-spam measures but the reality shows that it will most 
likely have minimum effect as its far too easy for spammers to adapt to
it anyway. There are however good reasons to have MARID as IETF WG anyway
and hopefully the worst ideas implementation details can be stopped and 
new ideas discussed in the future if the group is extended.
  Yahoo is different proposal which has nothing to do with MARID and is
being discussed at the ASRG. It is basicly a header containing a signature
added to mail message that signs the content (including headers) with 
public key encryption and with public key available in DNS to verify the 
signature at the other end. The idea is not new and its a good idea, but 
yahoo's implementation is just bad and I think it breaks far too many 
things (it breaks with almost all maillists) and offers security that is 
too weak because its based on 348-bit key size. It should have been done 
different by reusing most likely PGP implementation but with message 
signed by MTAs and public key available through dns and if necessary 
being split into multiple dns records to have each at < 512k.

---

From: Ted Hardie <[email-masked]>
Date: Fri, 28 May 2004 09:51:53 -0700

>their own ideas to it are wasting their time.

As the AD who sponsored this work, I have to disagree.   The MARID
work came out of the LMAP area of the Anti-Spam Research Group,
and there were multiple proposals there.  All of them are being
treated as input into MARID, and that fact is called out in the charter.
The recent interim meeting resulted in an agreement to work on
a converged spec taking ideas from SPF and Caller-ID.  There are
two other proposals on the table which address other parts of
the mail exchange, and there was a sense in the meeting that they
were sufficiently orthogonal that they might progress independently.
None of the work mentioned above relates to Yahoo's proposal.
Anyone interested in the work is welcome to participate in
MARID's mailing list; it has a very tight deadline and a very high
volume mailing list, and those willing to put engineering effort
into it are more than welcome.

Speaking as a participant, I have to say that this is a hard set of
problems, both to define well and to solve.  The efforts to
define it well do occasionally drift into layer 9, and limiting
that is something everyone involved has to watch.  But
I do believe there are some tractable pieces here we can pull
off of the problem and solve, and I believe the working group
is committed to that task, no matter who proposes the solution.

			regards,
				Ted Hardie

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Fri, 28 May 2004 21:07:39 +0200

On 28-mei-04, at 15:06, John Stracke wrote:

>>> utilizing zombie machines that snarf the already-stored credentials 
>>> of the user to send mail)....

>> The question is whether spammers can obtain new credentials (stolen 
>> or otherwise) faster than others can blacklist them.

> And, if you had actually read the message you replied to, you would 
> have realized that the answer is yes.

I don't see why.

> Send out a worm that makes N zombies, have each zombie send one 
> message under the local user's credentials, and none of them will get 
> blacklisted.

That makes the number of spam messages received by an email user (on 
average) equal to the number of email users divided by the number of 
systems vulnerable to becoming a zombie. So one spam a day/week/month 
or so = a lot better than the current situation.

Don't assume that the high level of vulnerability we're seeing today 
will remain the same in the future. (It will remain > 0 though.) There 
was a time when desktop systems would completely crash regularly 
because badly written software would take down the whole system. 
Software quality isn't beter these days, but desktop operating systems 
are now able to protect the system against most software errors. I'm 
sure we'll see similar developments in the area of security. Zone Alarm 
(network access restricted on a per-application basis) and the MacOS 
keychain system (access to passwords and certificates restricted on a 
per-application basis) are the way of the future.

-- 
"Every computer sold in the US is safe by default.  It is powered off,
disconnected, in a factory sealed box" - Sean Donelan, on NANOG

---

From: Måns Nilsson <[email-masked]>
Date: Fri, 28 May 2004 22:12:00 +0200

--On Thursday, May 27, 2004 12:51:49 -0600 Vernon Schryver
<[email-masked]> wrote:

> block port 25 for all types of IP
> "Full Internet Connectivity."  

(agreeing with Iljitsch on this snippet) 

I have a *very* hard time seeing an IETF document (or discussion on the
list) coming even close to endorsing this blocking malpractice. It does not
scale (forcing people to use central, probably misconfigured, relays, and
it is IMNSHO thorougly bad engineering to try solving L8 problems on L3/4. 

-- 
Måns Nilsson                    MN1334-RIPE
http://vvv.besserwisser.org     +46 706 81 72 04
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 07:06:45 -0600 (MDT)

> From: =?ISO-8859-1?Q?M=E5ns_Nilsson?= <[email-masked]>

> it is IMNSHO thorougly bad engineering to try solving L8 problems on L3/4.

So say each of you who feel you have a right to pay less than what
providing full internet connectivity costs.   Full connectivity is
priced at about $100-$250/month, and plausibly and apparently costs
less to provide.  The $20-$30/month services provided by the providers
that cannot afford real abuse desks or local technical support are not
really Internet service, no matter that you might wish.

What I find really strange thing is the price point chosen for this
divinely ordained right.  Why is $300-$400/year ok but $200/month is
a violation of your fundamental human rights?  Why is paying what Full
Internet Connective costs evil and wrong, but it is ok to pay more
than the $300/year that people in some parts of the world live on for
a whole year?

The scaling argument is obvious nonsense.  If having $30/month
customers use SMTP servers provided by their ISPs did not "scale",
then it would not "scale" to have those same customers use the
routers provided by those same ISPs.

If your ISP is incompetent at configuring an SMTP server, then whose
fault is it that you continue to buy bad service?   Why don't you treat
your incompetent locl provider of "Client only, non-public address"
or "Client only, public address" as a provider of those services and
use them only to connect to a system where you get competent Full
Internet Connectivity?

If ISPs and their customers were willing to deal with spam, including
immediately and permanently terminating customers that send any spam,
regardless of whether they are paid for their efforts (e.g. operators
of trojan zombies), then there would be no spam problem.

Why should the rest of us subsidize your ISP and your connectivity by
accepting SMTP/TCP/IP SYNs from your neighbors that are more than 99%
likely to be spam from trojan zombies that your ISP cannot be bothered
to terminate?

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sun, 30 May 2004 10:04:50 -0400

This would be a very interesting philosophical argument if in fact what 
we were discussing was something that could take a significant bite out 
of spam.  In the absence of such an ability, however, the real question 
is whether user accounts should be crippled in the name of spam 
fighting when the crippling *isn't* going to help significantly with 
the spam problem.  And that's not a philosophical debate, just a matter 
of common sense.    Grocery stores probably have the right to require 
their customers to wear formal attire, but if they don't have a good 
reason to do it, they're going to drive away customers no matter what 
the outcome of any philosophical debates.  My expectation is that ISP's 
who implement anti-spam measures that are both intrusive and 
ineffective are going to drive away customers as long as there's a 
better alternative out there, and I'd be inclined to simply let them do 
it unless they're in near-monopolistic market positions.  The latter 
exception is important, however; I'd certainly be upset if my cable 
provider did it, because I don't have any good alternatives.  -- 
Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 08:45:41 -0600 (MDT)

> From: Nathaniel Borenstein <[email-masked]>

> the outcome of any philosophical debates.

Grocery stores frequently requires shirts and shoes.  A better analogy
is that grocery stores that sell alcohol or other regulated drugs are
required to pay substantial extra costs.  Complaints about monopolies
in the beer and wine trade are laughed at, as are demands that pharmacies
in grocery stores not charge prices high enough to pay their pharmacists.

As Mr. Borenstein knows, a substantial fraction and probably most spam
is current sent using $30/month consumer accounts.  The spam that is
not sent using such accounts is very easily blocked.  As he knows, if
providers of those services would either filter port 25 or terminate
customers running trojan zombies, that spam would stop.  Providers of
those $30/month accounts have made clear that they cannot afford to
hire the people to monitor and deal with their abusive customers.  That
is why many of the providers of those $30/month accounts submit their
own IP address blocks to various "dynamic" backlists or block port 25
themselves.

Stopping trojan zombies would not end the spam problem, but it would
be a major improvement.  You can see the truth of that in the results
of UUNet's imposition of port 25 filtering on its dial-up resellers.
It would also significantly improve security problems caused by Microsoft
systems, because viruses and worms could be filtered by ISP SMTP servers
from outgoing mail.

>                                            My expectation is that ISP's 

It is dishonest to imply that cable TV providers have near-monopolistic
market positions in providing Internet service.  They often have near
or true monopolies in providing cable TV service.  However, in no U.S.
market do cable TV providers have anything like monopolies in providing
Internet service.  They may have monopolies in providing some of
services at $30/month, including "Web connectivity," "Client only,
non-public address," and "Client only, public address."  Mr. Borenstein
can buy Full Internet Connectivity from many service providers, although
not at $30/month.

Mr. Borenstein and others like him expect the rest of us to subsidize
their $30/month connectivity by dealing with the network abuse of his
fellow customers, because they find $30/month comfortable.  That position
would be less despicable if they would demand free Internet connectivity,
since that is the only price that billions of other people can afford.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sun, 30 May 2004 12:08:40 -0400

On May 30, 2004, at 10:45 AM, Vernon Schryver wrote:

> fellow customers, because they find $30/month comfortable.

Just for the record, I spend plenty more than $30 per month on Internet 
connectivity, as does my employer.  My views on this have nothing to do 
with the cost of my Internet service, which is why I said nothing about 
such costs.  Since your message seems to be based entirely on a 
misguided assessment of my motives, there's not much else in it that 
needs to be answered.  (We could argue forever about what constitutes a 
monopoly, but I doubt any minds would be changed.)

Port 25 blocking may be sometimes necessary simply to preserve the 
integrity of a network under heavy spam attack.  But I believe that a 
long-term solution is possible that will be both more effective and 
less restrictive.  My own focus is on that long-term planning, and I 
just can't see port 25 blocking as anything more than a rather 
problematic stopgap measure in advance of a more spam-resistant 
infrastructure for SMTP message submission.  -- Nathaniel

---

From: Mark Smith <[email-masked]>
Date: Mon, 31 May 2004 01:56:04 +0930

On Sun, 30 May 2004 08:45:41 -0600 (MDT)

> > From: Nathaniel Borenstein <[email-masked]>

<snip>

> As Mr. Borenstein knows, a substantial fraction and probably
> most spam is current sent using $30/month consumer accounts. 
> The spam that is not sent using such accounts is very easily
> blocked.  As he knows, if providers of those services would
> either filter port 25 or terminate customers running trojan
> zombies, that spam would stop.  Providers of those $30/month
> accounts have made clear that they cannot afford to hire the
> people to monitor and deal with their abusive customers.  That
> is why many of the providers of those $30/month accounts submit
> their own IP address blocks to various "dynamic" backlists or
> block port 25 themselves.
> 

Do you have more information or references regarding your
statements above? I'm interested in any studies etc.

I would find TCP port 25  being blocked by my ISP to be
unacceptable. It isn't the Internet anymore. The Internet's job
is to shunt around IP packets, irrespective of what is in them.

My anti-spam measures are so effective that I can't remember the
last spam I received. I would find not be able to run my own MTA,
unfortunately on a dynamically assigned IP ADSL service, as that
is all I can afford, to be far more costly than the very
negligable reduction in spam I would receive if TCP port 25 was
blocked by ISPs.

Regards,
Mark.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 10:47:25 -0600 (MDT)

>Received: from mail.optistreams.net (206-169-2-196.gen.twtelecom.net [206.169.2.196])
>        by calcite.rhyolite.com (8.12.11/8.12.11) with ESMTP id i4UG8bio077225
>        for <[email-masked]> env-from <[email-masked]>;
>        Sun, 30 May 2004 10:08:38 -0600 (MDT)

> integrity of a network under heavy spam attack. 

Perhaps I am mistaken, but I believe that Mr. Borenstein has mentioned
his costs in the past.  His recent talk about the supposed "near
monopolies" of "cable providers" makes absolutely no sense except
in the context of $30/month services.

The copy of his message appears to have been sent to my SMTP server
from one of those $30/month accounts.  Mr. Borenstein certainly has
complained about some sort of blocking of his mail.  I think that
blocking involved a cable provider account.  However, if the blocking
that bothered him was not from his TimeWarner acocunt, then perhaps
this is relevant:

traceroute to guppylake.com (64.71.173.70), 64 hops max, 44 byte packets
11  ix-8-0.core1.SanJose.teleglobe.net (66.198.97.18)  59.309 ms
12  pos2-3.gsr12416.pao.he.net (66.220.13.42)  119.297 ms
13  pos2-0.gsr12012.fmt.he.net (64.62.249.121)  61.106 ms
14  64.71.173.70 (64.71.173.70)  62.479 ms

traceroute to thehideout.net (64.71.176.110), 64 hops max, 44 byte packets
13  pos2-0.gsr12012.fmt.he.net (64.62.249.121)  60.953 ms
14  64.71.176.110 (64.71.176.110)  61.028 ms

Hurricane Electric has earned a reputation as a provider that avoids
dealing with reports of spam sent by its customers except by
forwarding them reports to its customers.  See
http://groups.google.com/groups?scoring=d&q=+%22he.net%22+group%3A*email
http://groups.google.com/groups?scoring=d&as_epq=Hurricane%20Electric 
http://groups.google.com/groups?scoring=d&q=+%22he.net%22+group%3A*abuse*

Juging from http://spews.org/html/S2100.html 64.71.173.70 is currently
listed by SPEWS at level 2.  (I do not use or advocate SPEWS' list;
I'm pointing out SPEWS' data only to support my point about the supposed
unfairness of the blocking of Mr. Borenstein's mail.)

>                                                  But I believe that a 
> infrastructure for SMTP message submission.

People have been talking about such ideas since Cyberpromo's day.  The
closest thing that has ever been implemented and proven effective is
blocking port 25 SYNs from blocks of IP address that have a better
than 99.9% probability of sending only spam and worms, namely the IP
addresses of spammers and of "dynamic address."  In practice the latter
is synonmous with block port 25 for $30/month accounts.

Blocking port 25 from $30/month accounts does not affect SMTP-SUBMIT,
which is the IETF standardized "spam-resistant infrastructure for SMTP
message submission."   One must wonder how Mr.  Borenstein's mail could
be blocked by the sort of blocking he has repeatedly complained about
if he used SMTP-SUBMIT to reach reputable MTAs.

Note also the disconnect between the reverse-DNS of Mr. Borenstein's
SMTP client and his envelope Mail_From and header From: values,
and the lack of DNS RRs supporting any of the proposals for DNS-based
sender authentication.  According to the advocates of those mechanisms,
Mr. Borenstein's is "forging" his messages.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 11:04:32 -0600 (MDT)

> From: Mark Smith <[email-masked]>

> statements above? I'm interested in any studies etc.

The easiest study is to look at your own spam load.

The most recent public study or reliable comment I'm aware of 
was the statement from Comcast about how much spam they send in
http://news.com.com/Attack+of+Comcast%27s+Internet+zombies/2010-1034_3-5218178.html

See also http://www.senderbase.org/?searchString=comcast.net&searchBy=domain
and http://www.senderbase.org/

(I do not believe SenderBase's numbers are accurate to better than
several percent of total Internet mail or tens of millions of
msgs/day.  I know that their numbers for the domain names and IP
addresses I control are nonsense, but my domains and addresses are
directly involved with 5 or 6 orders of magnitude less mail than
those listed in http://www.senderbase.org/ )

> is to shunt around IP packets, irrespective of what is in them.

That is inaccurate.  From ancient days it has also been the job
of people running things to prevent traffic that would violate
various agreements, AUPs, TOS, and so forth.

> last spam I received. 

Yes, spam filtering can be quite effective.  I say this based in part
on the results of the DCC, which handled about 136,000,000 mail messages
on May 26.  However, the effectiveness of input filtering is irrelevant
to the need to deal with spam at its sources.

>                       I would find not be able to run my own MTA,

I cannot understand that as other than a demand that I subsidize your
Internet service.

If you think that everyone has the right to run their own MTAs, why
don't you insist that Full Internet Connectivity be free?

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sun, 30 May 2004 13:40:25 -0400

Please stop this random speculating.  The ISP that was blocked is not  
my current ISP (I moved last fall), so none of this is relevant.  And  
if I'm dealing with Hurricane now, well, that's the first I'd heard of  
it, since I'm downstream on a hosted service and never bothered to  
check who all my upstream providers are.  Are you seriously asserting  
that I deserve to be blocked if I don't confirm that all my upstream  
ISP's are complying with J. Random Blacklist?

However, you are right that my current laptop configuration is one of  
many that won't work when Caller-ID or SPF records come into use for  
the domain guppylake.com.  At that point, obviously, I will change my  
laptop's configuration.  My sincere hope is that by the time that  
happens, I will have a better option for smtp submission.  Blocking  
port 25 will most assuredly *not* help that problem.  -- Nathaniel

On May 30, 2004, at 12:47 PM, Vernon Schryver wrote:

> http://groups.google.com/groups? 
> scoring=d&q=+%22he.net%22+group%3A*abuse*
>

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 12:27:42 -0600 (MDT)

> my current ISP (I moved last fall), so none of this is relevant. 

So what ISP was blocked?  Why do I suspect you are being disingenuous
and that it was a $30/month account?

>                                                                   And  
> check who all my upstream providers are. 

As always, the buyer must beware.  Adopting the terminology in
draft-klensin-ip-service-terms-01.txt or similar would help.  Hurricane
Electric could say that its IP addresses may not be optimal for SMTP
clients but are useful for SMTP, HTTP, and other servers.

>                                           Are you seriously asserting  

That is a obviously an intentional distortion of my point.  However,
now that you "ask," then yes, you do "deserve" to have your mail
blocked if you buy service from a provider with a reputation for
being friendly to spammers.  Your failure to exercise due diligence
does not impose an obligation to accept more spam on others.  You
"deserve to be blocked" more than the rest of us "deserve" to receive
the spam that helps support Hurricane Electric.

> port 25 will most assuredly *not* help that problem.  

On the contrary, Caller-ID and SPF would not stop as much spam without
collateral damage as blocking port 25 from TimeWarner, Comcast, and
other $30/month service providers.  Caller-ID and SPF cannot have
significant effects against spam for at least the 5-10 years before
most domains support them.  Caller-ID, SPF, and the rest would in
effect block port 25 about the same IP addresses as simple port 25
blocking of $30/month accounts, in the unlikely event that Caller-ID
etc. ever have any effects.  If you would switch to SUBMIT, you would
not care if your TimeWarner account is port 25 blocked, except that
you might expect TimeWarner's prices to drop for needing even less
abuse-desk staff.  On the other hand, port 25 blocking can be done
today and has immediate good effects against spam, as well as worms
and viruses.

Of course, port 25 is not a panacea for spam, worms, or viruses.
Of course, some viruses and spammers would adopt the obvious
countermeasure of using the ISP's servers, but many would not.
Besides, the ISP is could filter or at least rate limit, and there
are no easy countermeasures for spammers against that.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sun, 30 May 2004 16:00:12 -0400

On May 30, 2004, at 2:27 PM, Vernon Schryver wrote:

> So what ISP was blocked?

What are you, the ISP police?  Not that it's any of your business, it 
was X0 DSL and I paid just under $100/month and hosted my server at 
home; it was blacklisted as part of a larger block of IP addresses 
beyond my control.  When I moved physically, I took the opportunity to 
move my server to a hosted service for guppylake.com, and NOW am on a 
normal cable modem at home.  I've been associated with the domain 
guppylake.com for almost twenty years, however, and I rather like to 
continue sending mail from that address even though I now obtain my 
bitstream from Comcast.

But I imagine that X0 is also on your list of ISP's-that-are-evil, so 
it was my fault for using them in the first place.

> Why do I suspect you are being disingenuous

I don't know, perhaps because you have a suspicious nature and are 
quick to assume the worst about people?  I am not really the sort of 
person who tells lies on an IETF list just to make a point.

For my part, I am sufficiently paranoid to fear that ISP's might 
advocate port 25 blocking because they hope it will lock people into 
email addresses that are less portable (e.g. [email-masked]).  But 
when they give other reasons, no matter how irrational I may think they 
sound, I try at least to give their sincerity the benefit of the doubt. 
   -- Nathaniel

---

From: "Perry E. Metzger" <[email-masked]>
Date: Sun, 30 May 2004 17:16:42 -0400

Nathaniel Borenstein <[email-masked]> writes:
> This would be a very interesting philosophical argument if in fact
> what we were discussing was something that could take a significant
> bite out of spam.  In the absence of such an ability, however, the
> real question is whether user accounts should be crippled in the
> name of spam fighting when the crippling *isn't* going to help
> significantly with the spam problem.

But it will. Almost all of my spam comes via incompetent end users
who've had their machines taken over by the bad guys. Blocking dynamic
IP ranges also nukes a very large fraction of my spam.

I think the easy solution is just to block port 25 unless someone asks
for it to be opened. Average users have no idea what
port 25 does or even what TCP is, so they won't care.

Perry

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 15:48:02 -0600 (MDT)

> was X0 DSL 

Your repeated, unprovoked public complaints about the blocking that
affected you made XO's identity not the business of everyone who cares
about such issues.  Then there were your comments about "near monopolies."

>            and I paid just under $100/month and hosted my server at 

That reference that any list of mine of evil ISPs is disingenuous.
Besides, I bet you know as well as I do that RoadRunner probably
blocked that larger block of addresses because of lots of spam.
For a while XO was having difficulty acting against its spamming
customers.  I've not noticed such complaints for a while.

It does sounds as if you have made a habit of hiring ISPs without
exercising due diligence.  If that is true, you might blame your
parents but not me.   I don't blame you for the fact that until
recently I've always paid much more than $100/month to host my
vanity domain, but then it has not been blacklisted.  I have moved
it more than once when I lost confidence in an ISP.

> quick to assume the worst about people? 

Instead of using ad hominem, you might recall your own words such as

]      ... near-monopolistic market positions. The latter exception
] is important, however; I'd certainly be upset if my cable provider
] did it, because I don't have any good alternatives

Then there is your coyness about XO's identity.  Why didn't you come
out and name it at the start?

>                                          I am not really the sort of 

Where have I lied?  For your part, you have repeatedly intentionally
misrepresented my words and generally been disingenuous.  For example,
your words above imply that I had no business asking which ISP was
involved in the blocking you have repeatedly complained about.  You
made the identity of the ISP a relevant point by your demands that I
stop "random speculating" as well as by your repeated complaints about
RoadRunner's blocking.

> sound, I try at least to give their sincerity the benefit of the doubt. 

That is also disingenuous.  While I share concerns about locking
people into addresses, you know that blocking port 25 is unrelated
if people use some flavors of what you called "a more spam-resistant
infrastructure for SMTP message submission," such as SMTP-SUBMIT,
or simple "web mail."

Why don't you give RoadRunner's sincerity the benefit of the doubt
about the blocking of your XO address?  Did you check any of the well
know resources such as news.admin.net-abuse.sightings for evidence of
spam from your neighbors or did you just start complaining about evil
"near-monopolies"?

Do you have any substantive responses to my counters against your
claims that port 25 blocking is useless and harmful?  I claim 

 - port 25 blocking by $30/month providers would block little more
  than the spam that might someday be blocked by Caller-ID, SPF, etc.  

 - the legitimate mail blocked or false positives caused by port 25
  blocking is similar or less than that for Caller-ID, SPF, etc.

 - port 25 blocking can be implemented today piecemeal by individual
  providers on the sending side in routers and on the receiving side
  using blacklists, while Caller-ID, SPF, etc. must wait at least 5
  or 10 years until most of the Internet implements them.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Sun, 30 May 2004 18:51:30 -0400

This is a remarkably reasonable proposal, and I would have no objection 
to it (just a fear that ISPs might make it unnecessarily hard to get it 
opened, but they tend to make everything hard).  Heck, I might not even 
mind paying an extra dollar or two per month to have it open.  As long 
as consumers have an option, I'm fine with this as a default.  Good 
idea.  -- Nathaniel

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 18:26:33 -0600 (MDT)

> > port 25 does or even what TCP is, so they won't care.

and how does that proposal differ from what I wrote Thursday?:

]                                    block port 25 for all types of IP
] service except the one that draft-klensin-ip-service-terms-01.txt calls
] "Full Internet Connectivity." 

Mr. Borenstein recently wrote the following apparently about that:

} ... Grocery stores probably have the right to require their
} customers to wear formal attire, but if they don't have a good
} reason to do it, they're going to drive away customers no matter
} what the outcome of any philosophical debates.  My expectation is
} that ISP's who implement anti-spam measures that are both intrusive
} and ineffective are going to drive away customers as long as there's
} a better alternative out there, and I'd be inclined to simply let them
} do it unless they're in near-monopolistic market positions. The latter
} exception is important, however; I'd certainly be upset if my cable
} provider did it, because I don't have any good alternatives.

I don't mind in the least if Mr. Borenstein has changed his mind but
does not wish to say so.  I also don't care if he prefers the ancient
statement of the old idea offered by Perry Metzger.

I will mind if Mr. Borenstein resumes his campaign against the
supposed evils of blocking port 25.  Such unfounded complaints give
aid and comfort spammers and to marketing departments resisting
blocking port 25 for customers who aren't competent to use it.

Until consumer grade services providers such as Comcast do something
to stem the floods of spam they are sending, other organizations will
stem their incoming floods with bad tactics such as rejecting mail
from IP addresses with reverse DNS names containing "dsl".

---

From: Mark Smith <[email-masked]>
Date: Mon, 31 May 2004 12:59:52 +0930

On Sun, 30 May 2004 11:04:32 -0600 (MDT)
Vernon Schryver <[email-masked]> wrote:

> > From: Mark Smith
> > <[email-masked]>
> 
> > > people to monitor and deal with their abusive customers. 
> > > That is why many of the providers of those $30/month
> > > accounts submit their own IP address blocks to various
> > > "dynamic" backlists or block port 25 themselves.
> >
> See also
> http://www.senderbase.org/?searchString=comcast.net&searchBy=domain
> (I do not believe SenderBase's numbers are accurate to better
> than several percent of total Internet mail or tens of millions
> of msgs/day.  I know that their numbers for the domain names
> and IP addresses I control are nonsense, but my domains and
> addresses are directly involved with 5 or 6 orders of magnitude
> less mail than those listed in http://www.senderbase.org/ )
> 
> 

Thanks for those links, I'll have a read.

> > unacceptable. It isn't the Internet anymore. The Internet's
> > job is to shunt around IP packets, irrespective of what is in
> > them.
> 
> > My anti-spam measures are so effective that I can't remember
> > the last spam I received. 
> 
> Yes, spam filtering can be quite effective.

Not using spam filtering ... I don't like the chances of false
positives or negatives.

My idea is similar to the idea of abandoning a phone number if
you get too many prank calls. Similar to abandoning a phone
number, when I abandon an email address, I don't even see the
spam traffic - I'm not filtering it out.

I've got a bit of a description of what I'm doing at the
following URL.

http://forums.whirlpool.net.au/forum-replies.cfm?t=184280#r4

It's not going to be perfect, nor am I claiming it to be,
however, I've found it to be pretty effective.

  I say this based
> in part on the results of the DCC, which handled about
> 136,000,000 mail messages on May 26.  However, the
> effectiveness of input filtering is irrelevant to the need to
> deal with spam at its sources.
> 
> > unfortunately on a dynamically assigned IP ADSL service, as
> > that is all I can afford, to be far more costly than the very
> > negligable reduction in spam I would receive if TCP port 25
> > was blocked by ISPs.
> 
> I cannot understand that as other than a demand that I
> subsidize your Internet service.
> 
> If you think that everyone has the right to run their own MTAs,
> why don't you insist that Full Internet Connectivity be free?
> 

I struggle to understand how you make such a dramatic jump in
"position" (I can't think of a better way to describe it at the
moment). I can't see the logical progression from being able to
run an MTA, to getting Internet connectivity for free. Of course,
if you're really making that offer, I'm quite interested :-)

Why do I run an MTA, and want that ability ? Because I run my own
domain name (nosense.org), allowing my email addresses to be ISP
independent, and I use multiple subdomains for email, which means
I fairly regularly need to change the MTA configuration. My
broadly, I don't want to have to rely on an ISP running an MTA
configuration which may not best suit my needs, when those needs
are or may be different from the general requirements of their
user base. It's sort of a "if you want something done
properly, do it yourself" situation.

Regards,
Mark.

---

From: Mark Smith <[email-masked]>
Date: Mon, 31 May 2004 13:17:29 +0930

On Sun, 30 May 2004 17:16:42 -0400
"Perry E. Metzger" <[email-masked]> wrote:

> > This would be a very interesting philosophical argument if in
> > fact what we were discussing was something that could take a
> > significant bite out of spam.  In the absence of such an
> > ability, however, the real question is whether user accounts
> > should be crippled in the name of spam fighting when the
> > crippling *isn't* going to help significantly with the spam
> > problem.
> 
> But it will. Almost all of my spam comes via incompetent end
> users who've had their machines taken over by the bad guys.
> Blocking dynamic IP ranges also nukes a very large fraction of
> my spam.
> 

I really, really hesitate to suggest the following, I really hope
I'm not going to make the future happen by predicting it.

I'm just waiting for the next Outlook based (or alternatively, a
socially engineered executable based) worm that uses legitimate
email addresses and "legitimate" (in the sense of
"legitimate because TCP port 25 is not blocked") MTAs to send out
spam. Blocking TCP port 25 on dialup accounts (or any other
Internet service) will have no effect in mitigating these types
of attacks. Blocking TCP port 25 for ALL Internet access would be
the only way a traffic blocking technique would have any effect
in mitigating a spam delivery method like this.

> I think the easy solution is just to block port 25 unless
> someone asks for it to be opened. Average users have no idea
> what port 25 does or even what TCP is, so they won't care.
>

This isn't a bad idea, what it really does is adds a level of
manual, non-Internet, once-off authentication to the TCP port 25
service. The only question then is how well the authentication
procedures are followed. See Kevin Mitnick's book about those
problems.

Regards,
Mark.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 30 May 2004 23:20:49 -0600 (MDT)

> Not using spam filtering ... I don't like the chances of false

Today either you filter spam, or you get practically no mail from
strangers.  If your address is exposed for legitimate mail from
strangers, then lots of spam will be sent your way.  At least 50% and
by some accounts more than 80% of all mail is spam.  If you get the
10 legitimate message/day typical of a non-technical user, and your
spam load is 80%, then you also receive 40 spam/day.  My various layers
of filters averaged 521 spam/day for the last 40 days.

Either your computers filter using blacklists, whitelists, various
content filters, and/or other mechanisms, or you filter spam manually.
40, not to mention 521 spam/day are too many to filter manually without
frequently overlooking legitimate mail.  Those are false positives.
Thus, if your mailbox is open to legitimate mail from strangers, then
you have false positives, whether they are human or computer errors.

> spam traffic - I'm not filtering it out.

On the contrary, legitimate messages sent to your abandoned mailboxes
are false positives.  They are filtered out.

> run an MTA, to getting Internet connectivity for free. 

I thought you were repeating the too familiar whine that it would be
Wrong and Evil to be forced to choose between paying for Full internet
Connectivity and having port 25 blocked.  The familiar claims from
others about unblocked port 25 for $30/month being a fundamental human
right of communication are irritating.  Those making those claims want
only a price they can afford, instead of the $0.00 price appropriate
for a fundamental human right.
    ................

} From: Mark Smith <[email-masked]>

} I'm just waiting for the next Outlook based (or alternatively, a
} socially engineered executable based) worm that uses legitimate
} email addresses and "legitimate" (in the sense of
} "legitimate because TCP port 25 is not blocked") MTAs to send out
} spam. 

That is such an obvious countermeasure that you must assume it it
probably is already in use.

}       Blocking TCP port 25 on dialup accounts (or any other
} Internet service) will have no effect in mitigating these types
} of attacks. 

That is mistaken.  Spam, worms, and viruses sent through ISP mail
systems can be filter.  I understand that worm and virus filtering is
quite effective, but don't really know.  Filtering spam from an ISP's
own customers can be extremely effective.  For example, an ISP can
rate-limit customers to 10 or 20 messages/day, and require customers
to make arrangements for higher rates.

---

From: Michael Thomas <[email-masked]>
Date: Sun, 30 May 2004 23:57:43 -0700 (PDT)

Perry E. Metzger writes:
 > I think the easy solution is just to block port 25 

   You can stop right there. The rest is so much
   wishful thinking.

	   Mike

 > unless someone asks

---

From: Mark Smith <[email-masked]>
Date: Mon, 31 May 2004 17:06:23 +0930

On Sun, 30 May 2004 23:20:49 -0600 (MDT)
Vernon Schryver <[email-masked]> wrote:

> > Not using spam filtering ... I don't like the chances of
> > false positives or negatives.
> 
> Today either you filter spam, or you get practically no mail
> from strangers.  If your address is exposed for legitimate mail
> from strangers, then lots of spam will be sent your way.  At
> least 50% and by some accounts more than 80% of all mail is
> spam.  If you get the 10 legitimate message/day typical of a
> non-technical user, and your spam load is 80%, then you also
> receive 40 spam/day.  My various layers of filters averaged 521
> spam/day for the last 40 days.
> 

My email addresses, eg this ietf one, are exposed to a lot of
strangers on a daily basis. I'm not getting any where near the
spam levels you suggest. In fact, since this ietf email account
has been subscribed to this IETF mailing list (2004-04-18), I
don't remember getting any spam to it at all.

I have another one for the IPv6 mailing list, and another one for
the Sylpheed MUA. I don't remember getting any spam to them
either.

I may have got some in the last couple of weeks and deleted it,
however, compared to the number of legimitate emails I receive
and then delete from each of these mailing lists, coping with
spam is less than a minor inconvenience. As I said, I can't
remember any.

> Either your computers filter using blacklists, whitelists,
> various content filters, and/or other mechanisms, or you filter
> spam manually. 40, not to mention 521 spam/day are too many to
> filter manually without frequently overlooking legitimate mail.
>  Those are false positives.
> Thus, if your mailbox is open to legitimate mail from
> strangers, then you have false positives, whether they are
> human or computer errors.
> 
> 
> > My idea is similar to the idea of abandoning a phone number
> > if you get too many prank calls. Similar to abandoning a
> > phone number, when I abandon an email address, I don't even
> > see the spam traffic - I'm not filtering it out.
> 
> On the contrary, legitimate messages sent to your abandoned
> mailboxes are false positives.  They are filtered out.
> 

Ok, I'd accept that.

Note that people I trust to send me email use a different
address. I'd tell it to you, but I don't know you well enough to
trust you with it ...

> > > > unfortunately on a dynamically assigned IP ADSL service,
> > > > as that is all I can afford, to be far more costly than
> > > > the very negligable reduction in spam I would receive if
> > > > TCP port 25 was blocked by ISPs.
> > > 
> > > If you think that everyone has the right to run their own
> > > MTAs, why don't you insist that Full Internet Connectivity
> > > be free?
> >
> > "position" (I can't think of a better way to describe it at
> > the moment). I can't see the logical progression from being
> > able to run an MTA, to getting Internet connectivity for
> > free. 
> 
> I thought you were repeating the too familiar whine that it
> would be Wrong and Evil to be forced to choose between paying
> for Full internet Connectivity and having port 25 blocked.  The
> familiar claims from others about unblocked port 25 for
> $30/month being a fundamental human right of communication are
> irritating.  Those making those claims want only a price they
> can afford, instead of the $0.00 price appropriate for a
> fundamental human right.
>     ................
> 
> 
> 
> } From: Mark Smith
> } I'm just waiting for the next Outlook based (or
> alternatively, a} socially engineered executable based) worm
> that uses legitimate} email addresses and "legitimate" (in the
> sense of} "legitimate because TCP port 25 is not blocked") MTAs
> to send out} spam. 
> 
> That is such an obvious countermeasure that you must assume it
> it probably is already in use.
> 

I wasn't talking about a countermeasure. I'm talking about the
attack the spammers could come up with, once you prevent them
sending spam from, for example  dialup accounts, due to
outgoing TCP port 25 being blocked.

Block outgoing TCP port 25 on certain types of Internet access
effectively creates a low level "trusted" email infrastructure
ie. MTAs only being run by (supposably) competent ISPs or
organisations.

My point is that once that happens, spammers will then attempt to
exploit the trusted infrastructure, using techniques such as
taking advantages of flaws in scriptiable MUAs, using social
engineering attacks such as executable attachments, or attaching
to unprotected Wifi networks from a car in the street, and
sending spam via the "trusted" MTA that is inside the
organisation's firewall. 

> } Internet service) will have no effect in mitigating these
> types} of attacks. 
> 
> That is mistaken.  Spam, worms, and viruses sent through ISP
> mail systems can be filter.  I understand that worm and virus
> filtering is quite effective, but don't really know.  Filtering
> spam from an ISP's own customers can be extremely effective. 
> For example, an ISP can rate-limit customers to 10 or 20
> messages/day, and require customers to make arrangements for
> higher rates.
>

Would you want your ISP reading your false positives or
negatives private emails, to make up for the imperfections in
filtering software? I wouldn't.

I also wouldn't want to have to rely on them to do it in a timely
manner. My business might depend on it, and I'm sure I won't be
able to sue my ISP if I miss a business opportunity, as I'm
sure there would be an out clause in their terms of
service.

And finally, how do they know what is or isn't spam ? I wouldn't
want them making that judgement for me.

Regards,
Mark.

---

From: Nathaniel Borenstein <[email-masked]>
Date: Mon, 31 May 2004 09:23:11 -0400

On May 30, 2004, at 8:26 PM, Vernon Schryver wrote:

> does not wish to say so.

To the best of my knowledge I haven't changed my mind about anything, 
but I'm done with this argument.  Anyone who chooses to re-read the 
thread will see that you, Vernon, are the one who keeps bringing up the 
issue of what people pay for Internet service.  I just don't care in 
this context, but you seem convinced that I do and that every comment I 
make is predicated upon the position *you* think I hold on pricing.  So 
you're not arguing with me, you're arguing with a straw man, and I've 
got better things to do.

For the record, I have no problem with charging extra for enabling port 
25, given the potential extra costs involved.  If I said anything to 
indicate otherwise, I apologize for the confusion.  I do object to most 
current blacklists, but my reasons have nothing to do with cost.  -- 
Nathaniel

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 31 May 2004 21:59:29 +0200

Can this thread die, please?

>> Not using spam filtering ... I don't like the chances of false

[...]

> My various layers of filters averaged 521 spam/day for the last 40 
> days.

And how many false positives? Or don't you get to see these:

    ----- The following addresses had permanent fatal errors -----
<[email-masked]>
     (reason: 553 5.3.0 go away)

Hanging up on people is pretty rude. You should at least give a reason.

> Connectivity and having port 25 blocked.

As I've said before: the fact that you apps guys can't get your act 
together isn't enough reason for me to do more work at layers 3 and 4. 
Stupid network, smart hosts, remember?

And again: please let this thread die. Even if blocking port 25 were a 
good idea it's no use as it needs to be done for 99%+ of all hosts 
connected to the internet to have any effect, and that's not going to 
happen any time soon. (Lots of people still don't do any anti-spoofing 
filtering even though that doesn't generate support calls and has been 
best practice for years.)