Subject: Re: [Asrg] Call to Arms: Securing E-Mail, Controlling Spam, Empowering Users (fwd)

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 08 May 2003 22:29:36 -0400

>From: J C Lawrence <[email-masked]>
 >
 >PIFR has a crypto based proposal on the boards for spam control called
 >Tripoli:
 >  http://www.pfir.org/tripoli-overview
 >Its got the same CA-based identity verification problems as the other
 >crypto proposals we've seen here.

Apparently this proposal has caught media interest, it just appeared as a 
story on SlashDot:

http://slashdot.org/articles/03/05/08/1559216.shtml?tid=126&tid=111&tid=95

A quote from the press release:

"People For Internet Responsibility (PFIR) co-founders Lauren Weinstein and 
Peter G. Neumann today called on the Internet and Open-Source Communities 
to consider a proposal for the most significant and far-reaching changes to 
e-mail systems since the creation of the Internet and its ancestor ARPANET 
more than 30 years ago."

I guess the "Internet and Open Source Communities"  also refers to us.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Fri, 9 May 2003 19:33:19 -0400

It's the same old same old

    IF we knew the from addr was reliably matched to the MTA doing delivery
    THEN spam would (cease to exist, be reduced considerably, etc.)

NOT PROVEN.

As I've said several times before here, people are jumping on the
bandstand because they really want to be the ones who solve the spam
problem.

The grandstanding is breathtaking.

Unfortunately, they only reveal they don't know much more about spam
than a little SMTP, DNS, and they've seen some spam in their inbox and
went off and did some gedanken experiments based on this simplistic
information.

It's like someone trying to solve money laundering because they've had
some money and managed some bank accounts and did their taxes a few
times.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Fri, 9 May 2003 21:43:08 -0400

>     THEN spam would (cease to exist, be reduced considerably, etc.)

The only thing that is proven is that if you confire your mail server to
enfore a strict policy of HELO<->FORWARD DNS<->REVERSE DNS consistency
checking, then you will lose a boat load of mail.  Many mail admins merely
assign an IP, MX record, and 'make install' then there's NAT, NAT Proxy,
load balancing.....

One question that often lingers in my mind is that if mail admins can't
properly configure their servers today per RFC821...how will they respond to
another protocol standard?  Do we just institute a tough-love policy?  Do we
make it monkey proof?  Then there's a couple of big software players that
may/may not agree.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 09 May 2003 23:03:13 -0400

>     THEN spam would (cease to exist, be reduced considerably, etc.)

  Also not claimed.  See long flame wars previously on the list.

  Tilting at windmills is time-honored profession, though.  As is
attacking straw men.

> bandstand because they really want to be the ones who solve the spam

  Saying it repeatedly doesn't make it true, unless you desire
everyone to believe you, solely because you're An Authority.

> some money and managed some bank accounts and did their taxes a few

  It's like someone trying to delve into social motivations, because
they've talked to people, and are an expert in computer networking.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 09 May 2003 23:07:13 -0400

"Eric Dean" <[email-masked]> wrote:
> another protocol standard?

  Badly.  That's their problem.

  Sins of omission (failure to properly configure mail systems) are no
less henious than sins of commission (trying to send spam), so far as
the recipient of the deluge is concerned.

  Alan DeKok.

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 10 May 2003 10:46:36 -0400

Kee Hinckley <[email-masked]> wrote:
> No, it's our problem.  If it were really truly their problem, then we 
> would have all deployed "must have a reverse lookup" filters.

  I disagree.  Many people have chosen to deploy reverse lookup
filters.  I believe that the reasons why they haven't been more widely
deployed are at least in part due to the problems they have, in
attempting to discover "implicit" consent.  As Hadmut noted, that
process has high failure rates, and thus has lower incentive for
deployment.

> If they don't implement something, and therefore they get more 
> spam--that's fine.  But if they don't implement it and therefore we 
> don't get their email--that's a problem.  Needless to say, this ties 
> into the whole issue of incentives.

  I agree.

  But I'll bet that for most domains, incoming email is NOT
distributed evenly over all other domains.  This means that small
deployment may have large benefits, and alternately, whitelists can
be helpful when talking to sites which haven't deployed a proposal.

  Alan DeKok.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 9 May 2003 23:56:46 -0400

If they don't implement something, and therefore they get more 
spam--that's fine.  But if they don't implement it and therefore we 
don't get their email--that's a problem.  Needless to say, this ties 
into the whole issue of incentives.
-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Sun, 11 May 2003 12:46:06 -0400

> into the whole issue of incentives.

Of the million or so spams I receive every couple of days...I find that they
come from a variety of DNS registered, unregistered, reverse-DNS'd, bogus
HELO hostname, valid hostnames...sorts.

Spammers simply try everything...and the are much more educated about SMTP
filters and guidelines than most mail admins.  Mere compliance is not a
challenge for them though it does deter some activities...which still
results in a considerable amount of spam delivered anyway.