Subject: Re: [Asrg] Washington Post: Earthlink to Deploy a Challenge-Response System for

From: "John Fenley" <[email-masked]>
Date: Fri, 09 May 2003 14:43:13 -0600

>From: Vernon Schryver <[email-masked]>
> > From: "John Fenley" <[email-masked]>
> > ...
> > Ok, good point, but I was mostly thinking about copycats. Who knows how 
>many
> > other ISP's will copy what they do, but not put as much thought into it.
> >
> > A list created by the ASRG to help all prospective copycats from making 
>the
> > simple mistakes could save a lot of pain for everyone.
>
>I agree that a BCP for challenge-response spam defenses is a good idea,
>for future implementors.

Then we agree here. It can be a base to build on.

>I've not responded to you counters to my counters to your points about
>Challenge/Response systems, because unless you're working on an ID,
>I fear it would be a waste of effort.

So if we were agreed, how is communicating your ideas a waste of effort?
So you decided not to respond. come up with some suggestions of your own 
then.
Perhaps you don't like having to defend your ideas at every turn. I welcome 
it.
It makes those Ideas stronger.

John Fenley

_________________________________________________________________
MSN 8 helps eliminate e-mail viruses. Get 2 months FREE*.  
http://join.msn.com/?page=features/virus

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 9 May 2003 15:58:18 -0600 (MDT)

> So if we were agreed, how is communicating your ideas a waste of effort?

It is a waste to repeat things too frequently, particularly if you
don't have a stake in any resulting consensus.  I think Challenge/Response
systems are hopeless for the reasons repeatedly advanced by others.
C/R schemes are like RMX (with the new RR) in the sense that neither
will be widely used (RMX even worse).  Unlike RMX, C/R systems don't
have much potential for noise and distraction in the IRTF/ITF, because
they don't require any action by the IETF.  The worst effect of errors
in a C/R BCP would failing to discourage bad C/R systems, which is
uninteresting because the C/R notion is hopeless and not a big problem
even if I'm wrong about that.  Bad implementations of good ideas don't
survive unless they're pushed by very big outfits that also don't read
BCPs and RFCs.

> It makes those Ideas stronger.

I'd take offense at that if I didn't suspect you've confused me
with someone else.  It's not as if I've been shy about defending
ideas I care about.

Back to the main point, are you working on a C/R BCP document?  I'd be
honor bound to read a draft ID and comment as constructively as I can.
In short, talk about what a third party should write in an ID is cheap.
I try not to do too much of it.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Fred Bacon <[email-masked]>
Date: 09 May 2003 19:03:30 -0400

On Fri, 2003-05-09 at 17:58, Vernon Schryver wrote:
> I think Challenge/Response
> will be widely used (RMX even worse).  

I've been silently watching the RMX argument unfold for some days now. 
You have implied that it would not be widely adopted by users even if it
was approved as a standard.  I find this difficult to believe.  Part of
the problem is that the RMX scheme needs to be pushed in a different
way.  Arguing that use of an RMX record will lessen spam traffic is
really the wrong strategy for its adoption.  Instead, it should be
emphasized that RMX helps prevent identity theft by protecting your
domain name from abuse by a third party.

Executives regard their internet domain names as corporate assets.  RMX
provides them with a means to protect the integrity of that assest from
malicious use.  By advocating this aspect of RMX, system administrators
will almost certainly rush to adopt it once it is supported by DNS and
mail servers.  In fact, they would almost certainly pressure software
vendors to support it as rapidly as possible.

I'm not particularly sanguine about the ability of RMX to reduce spam in
the long run, but that is not its true benefit.  Mail abuse is more than
just the torrent of unwanted mail in which we are all drowning.  It is
also the abuse of our company and private assets by outsiders.  RMX
seems like a viable method for protecting those assets at very small
cost.

Just my .02 worth.

-- 
Fred Bacon <[email-masked]>
Aerodyne Research, Inc.