Subject: Re: Last Call: 'Email Submission Between Independent Networks' to BCP - Clarification

From: "Nicholas Staff" <[email-masked]>
Date: Thu, 16 Jun 2005 22:50:53 -0700

Because I have already recieved several comments relating to one aspect of 
my original post I thought a clarification was in order as I didn't explain 
myself properly and there is some misunderstanding.

When I wrote that "nobody would be complaining if spam primarily consisted 
of Bloomingdale's catalogues and coupon val-paks" I didn't mean we wouldn't 
complain if we recieved the same amount of spam but it was from legitimate 
companies.  I meant that maybe 1% of my spam comes from legitimate companies 
so if we got rid of the frauds we would have effectively reduced spam by 99% 
(by no means is that percentage anything more than a rough approximate 
estimate).

Best regards,

Nick Staff

Original post:

I'm sure many will think this a stupid comment, but in the hopes that some 
don't I'll point out that the largest and arguably most efficient messaging 
system in the world is built upon open relay.  Anyone can anonymously drop a 
letter in any mailbox in the US and while there's junk mail it's proportions 
are certainly nothing like spam.  Why the difference?  Well first I split 
spam into 2 categories:

1.  legitimate advertisements for legitimate products (whether solicited or 
unsolicited).
2.  Fraudulent mail, scams, cons, etc.

I think the email abusers almost entirely fall into the second category and 
that nobody would be complaining if spam primarily consisted of 
Bloomingdale's catalogues and coupon val-paks.

So I think we are attacking things the wrong way.  The methods we are 
using - whether blacklists or 'authorized email' is going to either prove 
fruitless or end up ruining the big picture, which for me is electronic 
communication for everyone, to everyone.  Using electronic means, I don't 
see how we can ever prevent spam and still have open global communication 
among disparate systems.  It would be a different story if one organization 
ran all email servers worldwide but that horrible thought aside there will 
always be holes and breaks in an authentication/authorization scheme unless 
people limit who they can communicate with, and even then there will be 
spam.

There's also the returns we see on our efforts to consider.  Think of the 
millions of man/woman hours spent trying to stop spam - so many hours it 
probably would have taken less to inspect every email by hand.  And then 
when you think (if you believe as I do) that everything can be gotten around 
and that security holes are as infinite as the imagination, well then you 
know there will always be some kid with a script (which also includes any 
real spammer) who will be able to get around your defenses within a week of 
them being implemented.

My last unconstructive comment is that simple systems scale lossless and 
complex systems grow in a complexity proportionate to their size.

Funny enough, I think the postal inspector's department came about because 
of the amount of scams being sent via mail shortly after the civil war (such 
a glut that it was bringing the postal service to their knees).  Yet the 
postal service remained open-relay - why?  Maybe because they realized that 
they didn't need to 'trace' scam-mail because scams are trace-inclusive as 
the scammer must include a point of contact.  Sure there's the occasional 
anonymous letter bomb but since their resources aren't spent blocking coupon 
mailers they are much more likely to catch the big stuff.

I know there are 8 trillion problems with this idea but I think in general, 
email fraud needs to become like mail fraud and there needs to be a team of 
inspectors who follow up on such reports and arrest violators (I know the 
Internet is bigger than the US, so of course it's up to each country how to 
handle it).  I'm sorry for the non-technical post but I think blacklists are 
disgusting (I don't care if they help or not) and I just think so much 
brilliance could be directed elsewhere.

Thanks and best regards,

Nick Staff
[email-masked]

-------------- Original message -------------- 
> >  it's possible to have open relays that don't contribute to spam.  but
> >  those relays need to employ some other means, e.g. rate limiting, to
>
> Rate limiting is a relatively recent technique.  Though very useful it 
> has...
> ummm, limited applicability.

mostly because of blacklists.  it was working fine for its intended purpose.

> One needs to be careful not to dismiss established techniques in favor of 
> the
> latest fashionable one that is not as well fully understood.

I don't know what you mean by "relatively recent", but I was doing it at 
least
as early as April 1999 - that's the last mod date on my source files.  RFC 
2554
only dates from March 1999.

> For example, rate limiting is used to control a single source. It's quite
useful
> when used at the destination. At a sufficiently well-run source network, 
> it
also
> can be pretty useful.

It's also pretty useful for preventing a relay from being exploited by 
spammers.

> The problem is with zombies.  They make mush of old-time models of spam, 
> since
> they demonstrate that a very small data stream from a single source can be
> leveraged into a very, very large data stream, given enough sources.

Rate limiting of this type (based on source IP address), if done properly,
doesn't
help or hurt zombies.  The rates need to be set such that zombies can send
directly
to the recipients' MXes as easily, and more reliably, as they can send the 
same
mail via the rate limiting SMTP servers.

> One can start imagining more complex rate-limiting models, but then we 
> would
be
> talking about research efforts.  A BCP is not supposed to rely on 
> research,
> especially when it hasn't been done.

Maybe you should stick to talking about things that you know something 
about.

> >  block spam.  the goal of such relays is to make it at least as easy for
> >  the spammer to simply contact the appropriate MXes for the destination
> >  addresses as to use the relays.  of course it is necessary for such
> >  relays to record source IP addresses, etc., so that they are as
> >  traceable to their origin as messages sent directly to MXes.
>
> I don't know how much experience you have trying to do such tracing, but 
> the
> spamops folks have made quite clear that it is both vastly more effort and
> considerably less productive, than one might expect.

That's a problem with mail relaying in general, not just with open relays.
Now if you want to discourage multi-hop mail relaying, that might actually 
be
useful for lots of reasons besides just traceability.

> >  unfortunately, the vigilante character of various open-relay blacklists
>
> blacklists are not the subject of this BCP.

This thread has pretty much diverged from the subject of your draft
document anyway.

> >  killed any attempt at this kind of innovation.  just as we're now in
> >  danger of various kinds of brain-dead "authentication" methods and
> >  meaningless requirements killing useful email functionality.
>
> new authentication methods are not the subject of this BCP.

You mean "your draft document".  It's certainly not a BCP as it's
currently written.

Keith

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

--
Best regards,

Nick Staff

-------------- Original message -------------- 

> > > it's possible to have open relays that don't contribute to spam. but
> > > those relays need to employ some other means, e.g. rate limiting, to
> >
> > Rate limiting is a relatively recent technique. Though very useful it 
> > has...
> > ummm, limited applicability.
>
> mostly because of blacklists. it was working fine for its intended 
> purpose.
>
> > One needs to be careful not to dismiss established techniques in favor 
> > of the
> > latest fashionable one that is not as well fully understood.
>
> I don't know what you mean by "relatively recent", but I was doing it at 
> least
> as early as April 1999 - that's the last mod date on my source files. RFC 
> 2554
> only dates from March 1999.
>
> > For example! , rate limiting is used to control a single source. It's 
> > quite
> useful
> > when used at the destination. At a sufficiently well-run source network, 
> > it
> also
> > can be pretty useful.
>
> It's also pretty useful for preventing a relay from being exploited by 
> spammers.
>
> > The problem is with zombies. They make mush of old-time models of spam, 
> > since
> > they demonstrate that a very small data stream from a single source can 
> > be
> > leveraged into a very, very large data stream, given enough sources.
>
> Rate limiting of this type (based on source IP address), if done properly,
> doesn't
> help or hurt zombies. The rates need to be set such that zombies can send
> directly
> to the recipients' MXes as easily, and more reliably, as they can send the 
> same
> mail via the rate limiting SMTP servers.
>
> > One can start imagining ! more complex rate-limiting models, but then we 
> > would
> be
& gt; > talking about research efforts. A BCP is not supposed to rely on 
research,
> > especially when it hasn't been done.
>
> Maybe you should stick to talking about things that you know something 
> about.
>
> > > block spam. the goal of such relays is to make it at least as easy for
> > > the spammer to simply contact the appropriate MXes for the destination
> > > addresses as to use the relays. of course it is necessary for such
> > > relays to record source IP addresses, etc., so that they are as
> > > traceable to their origin as messages sent directly to MXes.
> >
> > I don't know how much experience you have trying to do such tracing, but 
> > the
> > spamops folks have made quite clear that it is both vastly more effort 
> > and
> > considerably less productive, than one might expect.
>
> That's a problem with mail relaying in ge! neral, not just with open 
> relays.
> Now if you want to discourage multi-hop mail relaying, that might actually 
> be
> useful for lots of reasons besides just traceability.
>
> > > unfortunately, the vigilante character of various open-relay 
> > > blacklists
> >
> > blacklists are not the subject of this BCP.
>
> This thread has pretty much diverged from the subject of your draft
> document anyway.
>
> > > killed any attempt at this kind of innovation. just as we're now in
> > > danger of various kinds of brain-dead "authentication" methods and
> > > meaningless requirements killing useful email functionality.
> >
> > new authentication methods are not the subject of this BCP.
>
> You mean "your draft document". It's certainly not a BCP as it's
> currently written.
>
> Keith
>
> _________________! ______________________________
> Ietf mailing list
> Iet [email-masked]
> https://www1.ietf.org/mailman/listinfo/ietf
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Dean Anderson <[email-masked]>
Date: Fri, 17 Jun 2005 16:16:42 -0400 (EDT)

This is an interesting observation, and the SPF group shed some light on
this quite by accident last year.  One of the differences between CAN-SPAM 
and the IEMCC proposal that was rejected by anti-spammers in 1997, is that 
IEMCC proposed to label commercial bulk email with a special header. 
CAN-SPAM merely requires a postal address, phone number, unsubscribe URL 
and no forged headers. Its harder to automatically identify commercial 
bulk email, and so harder to count how much of "spam" is really CBE, and 
how much is just non-commercial annoyance.  Enter SPF:

Bulk commercial emailers jumped on the SPF bandwagon on the assumption
that SPF would mean their email would be subjected to fewer tests.  
People monitoring SPF records support noticed this, and reported it.  
Temporarily, this gave a fairly good label for commercial bulk email. It
was found that about 6% of SPAM was SPF-PASS.  So, it may very well be
that as much as 94% of what we call "spam" is non-commercial annoyance
rather that genuine commercial bulk email.  I had previously thought that
frauds and junk was probably a high percentage, but not that high.

It gives further credence to the view that we have an "pretend spam"/fraud
abuse problem, not commercial bulk email problem.

But some people would complain about genuine CBE, anyway. Although you
hear less of it today, the view of many more radical antispammers is that
spam (Commercial Bulk Email, ie Bloomingdales, etc) needs to be banned
completely. One of the early "spam" complaints is about Network Solutions
sending CBE to its domain registry subscribers. Today, many wouldn't think
that abuse, because the recipients were the customers of Network
Solutions.  

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Dave Crocker <[email-masked]>
Date: Sun, 19 Jun 2005 11:15:57 -0700

>  companies.  I meant that maybe 1% of my spam comes from legitimate

I am not sure how this line of discussion relates to the proposed BCP, but 
indeed discussions about spam need to distinguish between real companies that 
are too aggressive, versus the folks that might politely be called rogue but 
more usefully called criminal.  (Independent of whether they break laws, all of 
their behaviors are that of a criminal, in terms of trying to bypass filters and 
avoid accountability.)  

Real companies need real and appropriate rules.  We might not like these 
companies, but we can bring them under control.

Criminals, of course, need different methods.

So an attempt to bring this thread into some relevance for the Last Call:

The methods in the draft BCP are intended to close some holes and improve 
up-stream (source) accountability.  It's a small but necessary step towards 
finding ways to develop trust, since trust begins with accountability.  

  d/
  ---
  Dave Crocker
  Brandenburg InternetWorking
  +1.408.246.8253
  dcrocker  a t ...
  WE'VE MOVED to:  www.bbiw.net

---

From: Dean Anderson <[email-masked]>
Date: Sun, 19 Jun 2005 18:18:34 -0400 (EDT)

> finding ways to develop trust, since trust begins with accountability.

Except that, it doesn't close any "holes", nor does it improve up-stream
accountability.  Neither open relays nor lack of email authentication are
problems that are exploited by spammers.

All the BCP does is propogate myths that have never held up to analysis.
And somewhat worse, the BCP propogates these myths by assumption, without
discussion or analysis that reveals the fallacies of those myths.

So, this BCP should be rejected.

		--Dean

---

From: Tony Finch <[email-masked]>
Date: Mon, 20 Jun 2005 11:28:10 +0100

On Sun, 19 Jun 2005, Dean Anderson wrote:
>
> Neither open relays nor lack of email authentication are

Neither of those statements are true. I've already addressed the first.
Regarding the second, we dealt with an incident last year where a spammer
exploited an open proxy on our network to send spam; they evaded our port
25 block by using an unauthenticated outgoing SMTP relay. This attack was
easy for us to stop because they discovered the relay by looking up our MX
record; our MXs now handle incoming email only, and our outgoing relays
have an obscure name which makes them difficult enough to discover that
spammers don't bother. We are also moving our users to securely
authenticated message submission so the relays can be more thoroughly
locked down.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
BISCAY: WEST 5 OR 6 BECOMING VARIABLE 3 OR 4. SHOWERS AT FIRST. MODERATE OR
GOOD.

---

From: Dean Anderson <[email-masked]>
Date: Mon, 20 Jun 2005 16:20:21 -0400 (EDT)

> Neither of those statements are true. I've already addressed the first.

No, you haven't addressed anything. You made an assertion that doesn't
stand up: What is probably your customers' attempts to relay externally
does not represent spammers trying to abuse open relays. This is very
likely legitimate, by legitimate users.  This doesn't make your point.

The fact that you seem to get gratification at "blocking email" and
ASSUMING it is abuse, doesn't do you, us, your customers, or anyone any
good. It doesn't show that open relays are exploited by spammers. The fact
is, open relays aren't abused by spammers.  In 9 years, no genuine
commercial operation has ever abused our relay. And we look. We don't just
look at "relay denied"  log messages and impute bad motives, as you do.  
Instead, we look at the queued messages. We try to find the company
selling something; And there hasn't been any.  We found instead that this
is abuse queued by self-described anti-spammers aka "spamops" people
trying to "teach us a lesson" about running open relays. And when they
gave up on abuse and shut their "blacklists", we had no further abuse,
either.

> exploited an open proxy on our network to send spam; 

An open proxy on a machine run by your customer is still your customer,
and is therefore entitled to send email.

> they evaded our port 25 block by using an unauthenticated outgoing SMTP
> relay.

But they were your customer, and were therefore authorized to send email.  
If you had run SMTP AUTH, they would have obtained the password, because
they can INSTALL AN OPEN PROXY ON YOUR CUSTOMERS MACHINE.  Authenticating
the relay will do nothing.  Your problem is the open proxy.  Deal with the 
problem, don't invent a solution that won't fix the problem.

> This attack was easy for us to stop because they discovered the relay by
> looking up our MX record; 

Funny that you should call this as an "exploit". SPF (the email
authentication du jour)  will identify your outbound relays, too.

You are arguing in circles, making my points for me.

		--Dean

---

From: "Nicholas Staff" <[email-masked]>
Date: Mon, 20 Jun 2005 21:02:07 -0700

And what does accountability mean for you David?  Does it mean people being 
accountable for their own actions or does it mean people being accountable 
to you?
See what worries me is when you didn't understand the relevence of my post 
you didn't ask me one question.  You didn't give me the opportunity to be 
accountable. You decided for me and while doing that you somehow managed to 
state none of my points while at the same time stating all of yours as if 
that's what I had been trying to say.

I'm including my original post at the end of this one so people can decide 
for themselves if your confusion was in earnest or if you're just dishonest.

As for your BCP, well David, one of the innconveniences about having a place 
where everyone can say what they want is that everyone can say what they 
want.  Personally I think that's a pretty fair trade-off (though I'm sure 
the aptly named SPEW(s) would disagree).

**Original Post**

Thanks and best regards,

Nick Staff

[email-masked]

Best regards,

Nick Staff

----- Original Message ----- 
From: "Dave Crocker" <[email-masked]>
To: "Nicholas Staff" <[email-masked]>; <[email-masked]>; 
<[email-masked]>
Sent: Sunday, June 19, 2005 11:15 AM
Subject: Re: Last Call: 'Email Submission Between Independent Networks' to 
BCP - Clarification

I am not sure how this line of discussion relates to the proposed BCP, but
indeed discussions about spam need to distinguish between real companies 
that
are too aggressive, versus the folks that might politely be called rogue but
more usefully called criminal.  (Independent of whether they break laws, all 
of
their behaviors are that of a criminal, in terms of trying to bypass filters 
and
avoid accountability.)

  d/
  ---
  Dave Crocker

---

From: Dave Crocker <[email-masked]>
Date: Mon, 20 Jun 2005 21:09:10 -0700

>  you didn't ask me one question.

What makes you think I didn't understand the relevance of your post?

  d/
  ---
  Dave Crocker

---

From: "Nicholas Staff" <[email-masked]>
Date: Mon, 20 Jun 2005 21:28:46 -0700

Dean,

I couldn't agree with you more - thanks for saying it.

whats funny to me is if anything would have given spammers a reason to 
exploit open relays it would have been the blacklists.  I mean when you 
arbitrarily blacklist millions of their ISP's addresses you leave them with 
no other option.  Of course that would have fed the claims that open relay 
needed to be stopped which would have brought more support to the blacklists 
thereby forcing more spammers to seek out open relays, etc, etc, forever and 
ever.

----- Original Message ----- 
From: "Dean Anderson" <[email-masked]>
To: "Tony Finch" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Monday, June 20, 2005 1:20 PM
Subject: Re: Last Call: 'Email Submission Between Independent Networks' to 
BCP - Clarification

--Dean

---

From: "Nicholas Staff" <[email-masked]>
Date: Tue, 21 Jun 2005 00:53:01 -0700

I thought you didn't understand the relevance because you started your 
response with "I am not sure how this line of discussion relates to the 
proposed BCP" and you ended your response with "So an attempt to bring this 
thread into some relevance for the Last Call:"

To be honest I didn't understand why you wouldn't think it a relevant albeit 
dissenting post.  Anyway, we obviously both see very diffeent sides - 
hopefly if either of us are right that's the school of thought that will 
prevail.

Best regards,

Nick Staff
----- Original Message ----- 
From: "Dave Crocker" <[email-masked]>
To: "Nicholas Staff" <[email-masked]>; <[email-masked]>; 
<[email-masked]>
Sent: Monday, June 20, 2005 9:09 PM
Subject: Re: Last Call: 'Email Submission Between Independent Networks' to 
BCP - Clarification

  d/
  ---
  Dave Crocker

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 21 Jun 2005 08:34:16 -0400

On Tue, 2005-06-21 at 00:28, Nicholas Staff blames the victims:
> no other option.

"if anything would give burglars a reason to break windows, it would
have been locked doors.  i mean, when you put locks on millions of
doors, you leave them with no other option."

people who send spam *always* have the option of changing their line of
work. 

						- Bill

---

From: Carl Hutzler <[email-masked]>
Date: Tue, 21 Jun 2005 08:57:41 -0400

[email-masked] wrote:

>>exploit open relays it would have been the blacklists.  I mean when
>>    
>>
>you 
>  
>

I appreciate all of the substantive comments on the BCP draft so far. 
But I would appreciate if fluff like the above were directed to another 
list/form....something other than the IETF/IESG. It simply does not 
provide any technical benefits and simply causes me and others to have 
to read more email. To be honest, anyone who has been as involved with 
operational spam fighting as myself and the co-authors understands these 
arguements all to well. No need to replay them here.

It sorta is spam, IMO :-)

Also, I am working with the team of co-authors to compile the legitimate 
comments and suggestions and I intend to publish them back to the team 
that submitted those comments shortly. We will keep the IETF/IESG lists 
apprised of our progress.

-Carl

-- 
Carl Hutzler
Director, Host Mail Development
America Online
[email-masked]
703.265.5521 work
703.915.6862 cell

---

From: "Nicholas Staff" <[email-masked]>
Date: Tue, 21 Jun 2005 07:11:53 -0700

And people who are not able to cope with SPAM *always* have the option of 
using snail mail.

I don't think limiting my freedom and restricting open global communication 
is a proportionate or appropriate solution for "too many advertisements in 
my mailbox".  deal_with_it

Best regards,

Nick Staff
----- Original Message ----- 
From: "Bill Sommerfeld" <[email-masked]>
To: "Nicholas Staff" <[email-masked]>
Cc: "Tony Finch" <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Tuesday, June 21, 2005 5:34 AM
Subject: Re: Last Call: 'Email Submission Between Independent Networks' 
toBCP - Clarification

you

- Bill

---

From: "Nicholas Staff" <[email-masked]>
Date: Tue, 21 Jun 2005 07:30:49 -0700

Carl-

In the future I'd appreciate you not cluttering my mailbox with "fluff" 
either, so please refrain from posting such non-technical and off-topic 
messages in the future.

Might I ask why you thought it OK to cause everyone else to waste bandwidth, 
time, and energy reading your off-topic post?

But thank you for reminding everyone of the scare-tactics and bullying you 
and other spamops types are so fond of.

Of course, maybe the problem is that you see these comments as fluff and 
don't understand how pertinent they are.

Best regards,

Nick Staff

----- Original Message ----- 
From: "Carl Hutzler" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Tuesday, June 21, 2005 5:57 AM
Subject: Re: Last Call: 'Email Submission Between Independent Networks' to 
BCP - Clarification

-Carl

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 22 Jun 2005 15:06:26 +0200

Everybody,

Most of the mail under this subject field is of little help to
the IESG in judging whether the draft in question is ready to
become a BCP. Please ask yourself "Does my message address specific
issues in the draft?" before hitting the send button.

Thanks

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter
IETF Chair
Distinguished Engineer, Internet Standards & Technology, IBM

---

From: Dean Anderson <[email-masked]>
Date: Wed, 22 Jun 2005 19:02:21 -0400 (EDT)

> I couldn't agree with you more - thanks for saying it.

You're welcome.

> exploit open relays it would have been the blacklists. 

No, this isn't the case, and ironically, it is anti-spammers that usually
made this assertion.  It isn't the case because intelligent spam-blocking
requires that the headers and message content be analyzed, ala spamassasin
and other tools.  Years ago, the unreasonable spamops folks insisted on
trying to block spam without receiving it: That is, to send a "550 no spam
accepted" type message before the SMTP DATA command. This kind of blocking
is not reasonable, since use of a relay, any relay (open or closed),
defeats the blocking scheme.  The often asserted goal of "saving
resources" is not valid because it is faster to queue the message and
analyze it afterwards than it is to hold up the mail process trying to
decide whether to reject it before receipt.

By contrast, intelligent analysis of the message headers and content can
block the message from a blocked host no matter what relays they used.  
(open, closed, authenticated, or unauthenticated). And this is what one
wants.

You should probably read http://www.av8.net/FTC.pdf, which details the
many fallacies promoted by anti-spammers about open relays.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 22 Jun 2005 19:43:06 -0400 (EDT)

There are several issues for the IESG:

In summary, people have brought up several reasons that this draft 
shouldn't be approved. But I think these are sufficient:

1) End run around SMTP developers, as Keith Moore pointed out. 

2) "spamops" past unreasonable and irrational demands and views require
careful scrutiny: Spamops needs to give consideration to lawful and
legitimate activity. People loosely associated with this group promised in
1997 to give a "technical solution" to spam. They have failed for more
than 8 years to do that, but have instead been associated with various
schemes to charge/extort fees for email services. In 1997, they rejected a
compromise with IEMCC that in retrospect was quite reasonable, and in at
least one way better than the CAN-SPAM law that was finally passed,
because IEMCC proposed to label spam with a header.  In retrospect, the
spamops community has been extremely unreasonable and irrational, and has
failed to deliver anything that was promised.

3) Assertions and assumtions in the draft are based on spamops "lore"  
rather than fact. This is bad engineering. The "issue" in the draft is
whether its assumptions and assertions about open relays and email
authentication are based on facts, versus the opinions of zealots.  
Neither open relays nor email authentication has been shown to be related
to spam: Neither promoting spam, nor preventing spam.

4) There are also numerous detailed problems with the language in the 
draft. However, in comparison with the major issues 1-3 above, these are 
minor, but also indicate that the document is not suitable for last call.

More inline.

> doors, you leave them with no other option."

Yes, there are some "burglars". But the open relay situation is much more
like gas pumps: Anyone can drive up and put gas in. That doesn't give them
the right to drive off without paying.

> people who send spam *always* have the option of changing their line of

Nonsense.  Real spammers, advertizing real products and real services have
the legal right to do so.  Blacklists have no legal right to block them.  
Exactis V.  MAPS, CAN-SPAM.  

Real spammers have no reason to abuse open relays.  And if they did use
them without permission, they would be easily blocked, easily found, and
then billed for those services. In 9 years, we've never found real
spammers abusing our relays. But we have found anti-spammers abusing them;
We've found anti-spammers soliciting abuse for them; We've found
anti-spammers telling people that open relays are free; And we've found
anti-spammers doing other mischief.  The "open relay" problem, is purely
due to anti-spammers.  The operational response:  Prevent anti-spammers
from discovering the relays, and you prevent abuse.  Real spammers aren't
searching for open relays, either.

		--Dean

---

From: Doug Royer <[email-masked]>
Date: Wed, 22 Jun 2005 18:53:48 -0600

I have not been following this topic closely.
To the point of open relays being a problem.

I think that the judgment as to if open replays are a problem
or not depends on which spam lists you are on.

With my system and by grep-ing through my last 4 weeks of logs
there were 22,870 of 26,157 spams blocked by my usage of two open
relay DNS-black lists blocking them from 14,131 UNIQUE IP addresses.
6,676 of which have no reverse-DNS. They seem to be in IP blocks of 
10-12. The other 2,616 spams that were DNS-blocked were from
non-open-relay lists. I still get 20-50 spams that make it to
my inbox every day.

The SORBS pages say they have over 3 Million such open relay
or open proxy (hacked or not) sites.

Spammers seem to setup open relays and use them. And as I do not
think that there are 14 thousand spammers, my guess is that the
spammer machines change their IP nightly or find a lot of open
relays. If it were not for open-relay DNS black lists,
I could not run my company.

About 90% of the the spam that is in my logs seems to be from
open relays.

I read your paper. And FYI,  I can name ONE person that is responsible
for about 60% of the spam that makes it into my inbox. So it is possible
that a few spammers are reading the anti-spam lists.

I can not me certain that the open-relay DNS-black lists are not
blocking other traffic. I only know which lists I subscribed to
after trial and error and looking at the logs to see which stopped
more spam.

-- 

Doug Royer                     | http://INET-Consulting.com
-------------------------------|-----------------------------

               We Do Standards - You Need Standards

---

From: Dean Anderson <[email-masked]>
Date: Fri, 24 Jun 2005 19:09:00 -0400 (EDT)

Brian Carpenter asked that the subject be changed.  I've also removed the 
IESG from the cc-list.

Doug, you've been misled. Inline.

> relay DNS-black lists blocking them from 14,131 UNIQUE IP addresses.

You cannot know from logs whether you are blocking spam or ham. You can
only see that you blocked messages. Like many before you, you've been
misled, but you probably feel much better thinking that you are blocking 
spam.

I'm not sure which blacklists you consider being "open relay" blacklists.
Since fall 2003 after most of the open relay blacklists shut, the
remaining "blacklists" don't search for or block open relays anymore.  
(though SORBS started up in March, 2005) Indeed, Matthew Sullivan of SORBS
recently tried to convince people on Nanog that he/SORBS was never
interested in open relays, but rather in open proxies. This claim (like
many of Sullivans), is belied by the facts: SORBS stands for "Spam and
Open Relay Blocklist", and there is a SORBS project on sourceforge from
2002, with an open relay scanner program.

> The SORBS pages say they have over 3 Million such open relay or open
> proxy (hacked or not) sites.

SORBS/Sullivan is a documented liar, and Sullivan's associate Alan Brown
(formerly of ORBS) has been proven in court to be a liar on 3 separate
court cases.  And Brown's only regret in those cases is that he told the
court the truth when asked if he had subscribers. ORBS was shut for
contempt of court when Brown published his blacklist instead of complying
with a court order to remove false entries.  You should review
http://www.iadl.org, although it is not complete.

> Spammers seem to setup open relays and use them. 

I think you are incorrectly analyzing headers. See below.

> And as I do not think that there are 14 thousand spammers, my guess is
> that the spammer machines change their IP nightly or find a lot of open
> relays.

I keep logs of TCP SYN packets to port 25 over a group of about 68,000 IP
addresses, and run non-production queue-only relays that serve as
honeypots for open relay scanning.  No one is scanning for open relays,
and no one has been scanning since most of the open relay blacklists shut
in 2003, with the exception of SORBS which only restarted in March.  
Prior to 2003, only open relay blacklists were doing the scanning. We
tested these blacklists as previously described, and fouund that they were
associated with, and a necessary component to open relay abuse. Block the 
open relay blacklists and prevent their scanning, and open relays aren't 
abused.

Further, I don't delete or block spam to several personal mailboxes.  
Years ago, I used to be able to go through my recently received spam and
quickly find an open relay abuse delivering spam to my av8 (and non av8)
email addresses. Today, this is the closest I could find:

Received: from dial-66-59-238-35.lcinet.net (dial-66-59-238-35.lcinet.net 
[66.59.238.35])
        by odie.av8.com (8.9.3/8.8.5) with SMTP id QAA24726
        for <[email-masked]>; Fri, 24 Jun 2005 16:43:27 -0400 (EDT)
Received: from chastiser ([235.245.195.212] helo=lurched.lcinet.net)
        by dial-66-59-238-35.lcinet.net with SMTP id 17C396B7
        for [email-masked]; Fri, 24 Jun 2005 16:43:26 -0400

Note that 235.245.195.212 is not allocated. This is a forged header.  
66.59.238.35 isn't running an open relay. Indeed, I could not find a
single open relay spam in a sample of 15 of the 605 spams I've received in
the last 24 hours. But I did find forged headers pretending to be open
relay. Though that is also becoming the exception. Much spam doesn't even
bother with forged headers.

> If it were not for open-relay DNS black lists, I could not run my
> company.

These are probably doing you more harm than you realize. Or are you a
promoter? (there are basically two kinds of users of these blacklists: The
misled who don't know, and the promoters, who know and don't care)

Most "open relay"  blacklists are revenge lists, and while they may block
some real spam [or possibly block pretend spam that they generated--they
call this "mailbombing"], their purpose is revenge and extortion.  This is
well documented: ORBS and its successors, SORBS, Osirusoft, Monkeys.org,
IMRSS. Most people "in the know" know that none of these blacklists are
suitable for blocking spam, and few ISPs or professional mail staff use
them.  You will just wind up blocking non-spam email.  Very few people use
these lists. We can tell:

We have been blocked by these lists since 1997, and have very little
problem with their "blocking". This is due to the relatively low number of
"subscribers".  Last month, we had just 2 issues with SORBS. Yet SORBS
blocks all of our IP address space claiming it to be hijacked.  Both
issues were with university student-run servers (GATech and UCLA). Neither
University's professionally-operated mail systems used SORBS. We had no
problem getting in touch with the professional University IT staff who
told us in both cases that the offending servers were student-run, and who
the student administrators were. One student admin was very surprised to
find out about SORBS. He said SORBS was recommended by some web site, and
he didn't know its revenge-oriented nature and false claims. He seemed
genuinely surprised, and after verifying for himself, genuinely shocked
and apologetic. The other admin was different: He clearly aware of SORBS,
and was very beligerent, telling me to "see figure 1", and other things.  
His supervisor, however, was surprised, and much less willing to block
non-spam email.  Both quit blocking.

See http://www.pathname.com/~corpus/NET.age for some stats on how much
spam and ham is blocked by SORBS and other blacklists.  The NET.age corpus
isn't that big, but still interesting because it is hand sorted into spam
and ham and compared.  SORBS is the only blacklist whose "Hijacked"
category blocks ham.

> About 90% of the the spam that is in my logs seems to be from open
> relays.

You are probably being "mailbombed" by the blacklist.  I have found that
blacklist subscribers sometimes have uniquely interesting spam profiles.  
If your blacklist is way more "effective" than it should be, something is
fishy.  Much spam is sent by residential machines, and many residential
ISPs use DHCP. So their IP addresses naturally change over relatively
short periods.  Ordinary blacklists should have difficulty keeping up with
this---Indeed, it should be just about impossible to keep up with DHCP on
millions of residential computers.  When the blacklist knows the dynamic
IP address of the abuser before it conducts abuse, something is wrong.

> that a few spammers are reading the anti-spam lists.

No doubt spammers do read anti-spam lists. The FBI also reads the
anti-spam lists. 

I rather doubt that one person is responsible for 60% of your (or anyone
elses) spam.  There were more anti-spammers than that abusing open
relays---we've tracked them down to the point were the FBI investigated,
and they were fired, and they __still__ didn't think that open relay abuse
was wrong.  But I agree that it probably isn't 14 thousand, either.

> after trial and error and looking at the logs to see which stopped

You can be certain they are blocking other traffic: Just look up
130.105/16 and 198.3.136/21 in ARIN and in SORBS.  Just google for ORBS. 
Or go to www.iadl.org, or www.dotcomeon.com.

---

From: Doug Royer <[email-masked]>
Date: Fri, 24 Jun 2005 19:47:40 -0600

> misled, but you probably feel much better thinking that you are blocking 

Of the two of us, you would NOT HAVE A CLUE about if I can or
can not read and understand my own logs :-)

I have been programming, administering, and building OS
for BSD and UNIX's for about 27 years. And for the last few
years Linux

When the logs do not tell me what I want, I modify the tool
to produce the logs I want.

I am sure that those 22,000+ spams were blocked by the DNS
list that "says" its an open relay list by SORBS and the other one.

> I'm not sure which blacklists you consider being "open relay" blacklists.

Which is why you HAVE NO CLUE about my system or how I CAN read my logs :-)

> bother with forged headers.

I do NOT rely on ANY information from the content of SPAM to tell me
anything. I use the getpeername() OS call to get the IP of the remote
sending system - live as they send it.

> misled who don't know, and the promoters, who know and don't care)

Nether, I am one that can NOT rum my business without blacklists as
I would spend my time reading 26,000 spams per month and not running my 
business.  I have no choice, I have to fitter them out. And SORBS
seem to get a HUGE percentage of them.  Again, this is by trial
and error and I do NOT just trust them. Try FOO-list,
try BAR-LIST, repeat until the percent of spam goes down.

> these lists. We can tell:

The -ONLY- complaints I ever got I check out myself. I manually
connected to those sites, and guess what - they were OPEN RELAYS!

I think over the last year (estimated 300 hundred thousand blocked 
message to my PERSONAL email box), I only got 5 or so complaints.
And ALL of them were open relays. 4 of them were hotels where people
send me personal email while they traveled. And all 4 of those hotels
whois contacts that I notified told me they would fix the problem of
their open relay. And all 4 of them did. And the rest (just a handful
or so at the most) ignored me. And only ONE complaint in the last year
was email I wanted.

That is almost ZERO false positives (That ONE was in fact
from an open relay site). In all cases reported to me the email
came from a site that was an open relay.

The reason that ISP's might not use them is because they have a
large variety of users some of which have local access providers
that have open relays. So the ISPs would be blocking their own
customers.

And because large ISPs have almost on a daily occurrence
one of their virtual host customers sites hacked and used
to proxy spam. They would be blocking themselves.

> non-spam email.  Both quit blocking.

All irrelevant to me. I can't spend time reading 22,000+ emails
per month just to find out if 5 or so were false positives.

> and ham and compared.  SORBS is the only blacklist whose "Hijacked"

Interesting, but not consistent with my data and logs.
SORBS has multiple lists. Which ones do they use?

> ISPs use DHCP. ...

About 1/2 of the IP address that are blocked seem
to be from DHCP addresses (just a guess by looking).

My spot checking shows that about 1/4 is fake PayPal, Bank, or
other fishing sites. Mostly from Asia. About 1/100 is in
languages I can't read (non-English messages) and I do
not care if those are false positives (relays) or not.

< So their IP addresses naturally change over relatively
> IP address of the abuser before it conducts abuse, something is wrong.

Many of the blacklist sites update their IPs from their honeypots
multiple times per day. It does not take much to auto-check them
for open relay in real time. Just take the REAL connect from IP
address and connect to port 25 and try it.

I sometimes turn off my usage of black lists and spot check the results.
I have not found ANY false positive in the last few months.

> elses) spam.  

I suspect the 60% is intentional. I helped several of my customers
block him. One sent him email telling him that 'Doug' found you.
The next day I got about 30,000 spams that day that made it
past SORBS (first one hit from that IP block I guess).

I do think that 60% of the email is a form of DOS attack.

I'll send you his name in private email.
I think he is from Australia. I know the name he uses, I am
still tracking him down.

At this point, I'll take this off the ietf list
and we can continue this between ourselves.

   --->>> I set the Reply-To of this message to me.

--

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 25 Jun 2005 23:56:55 +0200

> **** is a documented liar, and ****'s associate ****
> (formerly of ****) has been proven in court to be a liar on 3 separate
> court cases.  And ****'s only regret in those cases is that he told the
> court the truth when asked if he had subscribers. **** was shut for
> contempt of court when **** published his blacklist instead of complying
> http://www.****.org, although it is not complete.

This sort of assertion really has no place on an IETF list, regardless
of whether it's true. It's as ad hominem as you can get, and that
isn't how we debate here. Facts yes, people no.

Thanks
     Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 25 Jun 2005 23:58:29 +0200

Enough, gentlemen, please.

     Brian

Doug Royer wrote:
> 
> 
> Dean Anderson wrote:
> 
>> Brian Carpenter asked that the subject be changed.  I've also removed 
>> the IESG from the cc-list.
>>
>> misled, but you probably feel much better thinking that you are 
>> blocking spam.
> 
> 
>> and was very beligerent, telling me to "see figure 1", and other 
>> things.  His supervisor, however, was surprised, and much less willing 
>> to block
>> blacklist subscribers sometimes have uniquely interesting spam 
>> profiles.  If your blacklist is way more "effective" than it should 
>> be, something is
> ------------------------------------------------------------------------
>

---

From: Dean Anderson <[email-masked]>
Date: Sat, 25 Jun 2005 19:43:33 -0400 (EDT)

Facts, yes.  

"When you associate with anti-semites, you become one."

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Sat, 25 Jun 2005 20:21:44 -0400 (EDT)

The IETF cannot accept the statements of known, court-proven liars, nor
can it suppress this fact in its deliberations.  If the IETF accepts
court-proven and documented liars as reliable sources of fact, then it
will have no more credibility in its statements, as they will be based on
lies, not on truth.

My statement was not an ad hominem, but a statement of fact.

This is an ad hominem: 
http://www1.ietf.org/mail-archive/web/ietf/current/msg30606.html
In it, Paul Vixie calls my company by a derogatory name. It is a personal 
attack.   [No objection to that (and others), I note.]

Black's law dictionary defines Ad hominem as "To the person. A term used 
in logic with reference to a personal argument."

The key here is "logic". An ad hominem is a fallacy: Even if the person is
X (whatever), that does make not their argument invalid.  To have an ad
hominem, one have to refer personally to someone they are arguing with, as
Paul Vixie did in the reference above.

If a person really is a Jerk, their statements might still be true. Their 
being a Jerk, doesn't make them wrong.

The one and only exception is if "X" is "liar".  If a person really is a 
liar, then their statements probably are not true, and cannot be accepted. 
However, this is a serious charge, and needs proof. 

In this case, we have irrefutable in the form of multiple court decisions
which declared their associates to be liars, having defamed people on the
subject of open relays.  Our question is open relays, and their current
statements are about open relays.  

A fact, well established, that anti-spammers engage in lies about open
relays is certainly relevant to the question of whether the SpamOps
assertions about open relays are based in true facts or in lies.  Mr.  
Royer quotes the opinions of associates of known COURT-PROVEN liars to
support his arguments.  One person he quotes is well documented to have
perpetrated similar false statements against people (myself) who revealed
the lies of the court-proven liar.  The fact of their previous lack of
honesty on the subject is relevant to the truth of their assertions.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Sat, 25 Jun 2005 21:03:13 -0400 (EDT)

> can not read and understand my own logs :-)

I'm not saying you can't read logs. I'm saying there aren't any reliable
automated methods of determining whether a message came from an open 
relay.  So you are assuming too much about the meaning of your log 
entries.  That it came from a machine on an "open relay" blacklist, 
doesn't mean it came from an open relay.

> list that "says" its an open relay list by SORBS and the other one.

I've no doubt they did. But the blacklists' word doesn't mean anything for
several reasons. And furthermore, even by their own definition of what's
in their blacklist, it doesn't mean that. You are misquoting them. They 
indicate that their blacklist also contains open proxies.

> sending system - live as they send it.

The rest of this, I won't address. Its basically circular, since you are
subscribing to a list known to promote abuse open relays; You probably get
more open relay abuse as a result. This makes them appear more effective, 
and thus more valuable.

My only point is that by the indicator of hand analysis of recieved ppam,
and by the indicator of actual abuse of open relays, open relay abuse has
dropped off to nearly nothing since Fall of 2003. So it seems interesting
that you are still getting a lot of open relay abuse, and that open relay
abuse accounts for 90% of your spam.  This does not seem credible as a
general statement.  I'm not saying you are lying, but only that your
experience isn't generally experienced by others.

> and we can continue this between ourselves.

You'll have to quit using SORBS, if you want off-list email from me.

		--Dean