Subject: why eliminating spoofing is interesting; RE: [Asrg] seeking comments on new RMX article

From: "Bob Atkinson" <[email-masked]>
Date: Tue, 6 May 2003 12:02:46 -0700

An interesting observation is once you've eliminated the domain
spoofing, what you've then got in hand is a domain name that you can
reasonably believe has some amount of responsibility for the
transmission of the message. 

Domain name in hand, you can then ask yourself "What do I know about the
mail transmission policies of this domain? Do I know if they're
reasonable people?" There are any of a number of ways you might answer
this (that's a separate discussion) but if you don't have the
non-spoofed domain name in the first place, you can't get started.

	Bob

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Eric
D. Williams
Sent: Tuesday, May 06, 2003 11:32 AM
To: 'Dave Crocker'; Hadmut Danisch
Cc: [email-masked]
Subject: RE: [Asrg] seeking comments on new RMX article

On Tuesday, May 06, 2003 1:39 PM, Dave Crocker [SMTP:[email-masked]]
wrote:
8<...>8
> The reason that I refer to RMX as a point solution, rather than
> something with a real potential for getting at the core of spam, is
> because it "only" attempts to deal with From-field spoofing.
>
> Spoofing is bad, but it is not at all the core problem with spam.

But spoofing is one of the plethora of problems that are found with
'spam'.

[...]

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Tue, 6 May 2003 18:32:04 -0400

> transmission of the message. 

Not much more than you did by (intelligently) looking at the Received
lines.

One of the major sources of spam right now seems to be zombie robot
hosts, hosts who have had a virus injected into them which turns them
into unwitting spam slaves*.

So the spam is being delivered by 123-456-789-123-dsl-pool.telco.com
and guess what it seems to be from [email-masked]
who assures you that anything from (don't make me type it again)
is indeed from (I'm just not going to type it again.)

Now what do you know?

* Could someone please teleport that sentence back to the TCP-IP list
of 1985 and get the reaction?
-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg