Subject: RE: [Asrg] Is there anything good enough?

From: "Eric D. Williams" <[email-masked]>
Date: Tue, 6 May 2003 20:18:06 -0400

On Tuesday, May 06, 2003 6:26 PM, Barry Shein [SMTP:[email-masked]] wrote:
>
> On May 6, 2003 at 14:39 [email-masked] (Alan DeKok) wrote:
>  > Dave Crocker <[email-masked]> wrote:
>  > > Spoofing is bad, but it is not at all the core problem with spam.
>  >
>  >   So there's no point in solving one part of the spam problem, because
>  > the problem is larger than that.  Yeah, that makes sense...
>
> No, the problem is that this spoofing is a minor problem and any
> solution is easily evaded by spammers.

Please explain how.  I think as an exercise it would be instructive to give an 
example of how a spoofing solution would be evaded (easily).  I agree that 
spoofing is a problem (I do not know how minor as I get any where from 3-6k on 
my small operation per day) those are only the ones I see so I will not 
extrapolate that to the rest of the group.  Others are dealt with by filters 
and I will extract some numbers and perform analysis on those.  I still get 
'spammed' and I am not sure whether any ONE solution will suffice and be 
workable or lead to wide-spread adoption.

Also, please address (if you are interested) the issue of framework and 
architecture in proving a solution set.  My thinking is Dave's paper on control 
points is a start.

-e

-e
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Tue, 6 May 2003 21:37:02 -0400

On May 6, 2003 at 20:18 [email-masked] (Eric D. Williams) wrote:
 > Please explain how.

Ok, first off by just not using an RMX-enabled host. Using zombie
hosts or open relays or mail proxies, spam-friendly ISPs, etc, that's
what I was thinking of when I said "evaded".

I just meant, as I said previously, sticking (e.g.) @aol.com may be
attractive to spammers but it's not important, they won't miss a beat.

No more than blocking open relays ever slowed them down. They
(apparently) have lists of hundreds of thousands if not millions of
useful hosts and can switch between them rapid-fire.

See, if one doesn't understand their MO's one tends to imagine them
only doing stuff that's easy and comfortable to think about.

Further, if the spammers want to have that cake and eat it too they'll
do what they're doing now and use lookalike domains like @yahooo.com
(three 'o's) or A0L.COM (zero), ok that one's owned by AOL but you get
my drift. Or aol-mail.com or @eartlink.com or @earhtlink.com, whatever
153,276 other combinations the public is likely to fall for with just
about the same exact frequency as they would fall for [email-masked].

We're not going into a good space here with this RMX stuff.

As I said, RMX may solve some other problems, but it won't slow down
spammers, not more than a few microseconds anyhow.

 > architecture in proving a solution set.  My thinking is Dave's paper on control 

I don't think we're ready to go there yet although I think Dave has a
good idea trying to lay out the terrain.

My message, as someone who has sat on the front-lines of all this for
many years, is:

a) Spam is more subtle than most people, even those who think they
understand it, think.

b) It's unlikely a technical solution will ever work.

What might be more productive, for example, might be working along
with legal experts on technical changes which might help provide
evidence in court cases against spammers and similar miscreants.

I think sending a "chilling effect" as they call it in law would help
a lot with this problem. These are cowards, not heroes, we're dealing
with.

But I dunno, I'm not even ready to commit to that. But it's going to
be some sort of interplay between technical/social/legal/legislative.

Unfortunately, each group tends to sit down only with their own
because that's the most comfortable environment (they understand each
others' language and more's) and proceed to bang out a solution mostly
centered on the sphere they are comfortable with (lawyers suggest
court action, techies suggest algorithms, legislators suggest new
laws, etc.)

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Tue, 6 May 2003 20:44:10 -0400

>example of how a spoofing solution would be evaded (easily).  I agree that

You keep a variety of name servers around the net.  You register a 
new domain every day (or week, or however often you need to avoid 
blocking).  And each day you send authorized email "from" the new 
domain, using an authorization server that allows mail from any IP 
address.

There are already spammers that do the first part.  Second part seems 
easy enough.

Mind you, I'd love to have anti-spoofing.  I think a lot of companies 
would like the peace of mind it gives, and god knows I don't need any 
more letters from RIAA members telling me that somewhere.com is 
stealing their stuff.  I also think that moving spammers into a 
corner (registering real domains) is interesting.  Although in 
practice I haven't found those spammers any easier to track down than 
any others.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 07 May 2003 12:05:30 -0400

> only doing stuff that's easy and comfortable to think about.

  So the people coming up with proposals are stupid.

  That's a MUCH better argument than coming up with technical and
quantitative flaws in a proposal.

> b) It's unlikely a technical solution will ever work.

  Then please unsubscribe from the list, and get out of the way of
people who ARE trying to come up with a technical solution.

  Maybe a miracle will occur, and a solution you can't image will be
presented.  But that's less likely to occur if people sit here and
oppose every proposal, based on non-technical reasons.

  Alan DeKok.