Subject: Re: [Asrg] seeking comments on new RMX article

From: Scott Nelson <[email-masked]>
Date: Mon, 05 May 2003 10:23:28 -0700

At 09:33 AM 5/5/03 -0600, Vernon Schryver wrote:
>
>How does traceability and accountability reduce spam?  
>

I believe there are two schools of thought on fighting spam,
which I like to call "spam assassin" and "spammer assassin".

People in the spam assassin school are interested in not reading spam.
To them, anything that stops them from reading spam "works".
They would rate traceability and accountability as fairly unimportant.
what's done is done, and being able to track down the guilty party
isn't going to delete the spam.

People in the spammer assassin school are interested in stopping 
spam from being sent.
They would rate traceability and accountability as extremely important.

So to answer your question, 
Traceability makes it easier to catch the spammer,
and accountability makes it easier to punish them.
Ultimately, this reduces spam by reducing the total number of spammers,
and increasing the costs of the ones who remain.

Scott Nelson <[email-masked]>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 05 May 2003 14:38:08 -0400

> which I like to call "spam assassin" and "spammer assassin".

  I like your definitions.

> and increasing the costs of the ones who remain.

  Note that while currently SOME spammers may be traceable SOMETIMES,
there is likely still room for additional tracing and accounting.

  It's really a mind-set issue.  I want to have the ability to use all
of the tools at my disposal to fight spam.  Some people want to
prevent me from using certain tools, because they don't find those
tools useful.  Why that happens is question for psychology, and is
outside of the scope of this group.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 5 May 2003 13:39:52 -0600 (MDT)

> From: "Alan DeKok" <[email-masked]>

> ...

If you really think RMX (or anything else) is worthwhile, then you
should already have written and deployed some code.   So please say
how it's working.

In fact, no one is preventing you from using RMX or any other tactic
you like (subject to the terms of service of your ISP).  What you are
not getting are accolades for the silver bullet and volunteers to do
all of the work and then present it on a silver platter.

I think there are some early implementations of RMX, but that they
are not working is not the result of efforts of the "legacy internet
engineers" who prevented the spread of IPv8 and suppressed the discovery
of how to encode more than 4,294,967,296 addresses in 32 bit.

 ......

] From: "Eric D. Williams" <[email-masked]>

] ...
] I think the premise is that RMX is about finding a method to give 
] accountability.

] ...
] Part of the 'spam' problem lies in accountability.  ...

How so?  Why do you care who Alan Ralsky is, since you surely won't
be sending him bomb threats or signing him up for junk postal mail.

Who cares who "Bill Zhang" of "Sunshine" in China really is, besides
his ISPs and people who fight spammers instead of spam?  As long as his
ISPs connect his computers and those of his customers, what anti-spam
accountability does RMX or any mail sender tagging scheme give?  If RMX
or some other tagging scheme were universal, and if you could keep "Bill
Zhang" from signing up for as many RMX tags as he has domains, one might
argue that it could have some effect.  (He seems to make create several
new domains/day.  Why don't the ICANN rules against his obviously bogus
WHOS data make him "accountable" or stop him?)  It's trivial to recognize
mail from "Bill Zhang" by checking the whois data on the domain names
in his messages.  What is the difference between using port 53 or port
43 for "accountability" for his large volumes of spam?

What accountability is lacking but would be provided by RMX for the
unsolicited bulk email from Verisign, American Express, Roving Software,
Topica, and the rest of the Fortune 50,000 that would be our topic if
the "Bill Zhangs" were not so productive?  The Fortune 50,000 send
with unforged headers that point directly at themselves.

The immediate purpose of RMX bits is to let SMTP servers compare IP
addresses to sender domain names and so stop what some people call
forgery.  However, the RMX bits for commonly "forged" domains including
Yahoo, AOL, and Microsoft would say "all IP addresses can send from
our domain", because they have significant numbers of users who use
other sending ISPs.

Does SMTP-TLS enforce a valuable anti-spam accountablity?  SMTP-TLS
has been available for years for free in the popular SMTP implementations,
so why it used by less than 1%, not to mention more than 80% of the
net?  Every organization with web pages that can be fetched by HTTPS
has certificates that could be used with SMTP-TLS.  Most of those
certificates are signed by major commercial PKI vendors.  Why isn't
that "accountability" useful?  If it is useful against spam, why isn't
it being used?  Why is the RMX accountability useful but the SMTP-TLS
accountability useless?

The underlying problem is that people who advocate RMX, TOES,
authentication, or content tagging hope that some magic technology
will finger spammers.  They don't want to be bothered with the standard
work of collaring bad guys.  They don't care that counting coup on
spammers by saying "I know who you are" never stops any spam.  Those
who are serious about fighing spammers instead of fighting spam don't
need RMX or any of the other superficial quick fixes.  That's demonstrated
in web pages such as http://www.spamhaus.org/rokso/

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 05 May 2003 17:13:01 -0400

> should already have written and deployed some code.   So please say

  My apologies.  I had thought that ASRG was about discussing the
requirements and design of any solution.  Since that's wrong...

  OK, everybody, off of the list.  Let's use Vernon's criteria, and
say that the only people who can post to the list are those with an
anti-spam system used by 80% of the net.

  Hmm... where'd everybody go?  Even Vernon appears to have been
punted off of the list, as a result of applying that restriction.

> all of the work and then present it on a silver platter.

  Strange, I didn't ask for accolades, volunteers, or a silver
platter.

  I guess it's more ad homimen attacks from someone who has no other
way to defend his position.

> of how to encode more than 4,294,967,296 addresses in 32 bit.

  Yup.

> will finger spammers.

  ... with better precision and accuracy than their current methods.

  Yup, definitely.

>  They don't want to be bothered with the standard work of collaring
> bad guys.  They don't care that counting coup on spammers by saying
> "I know who you are" never stops any spam.  Those who are serious
> about fighing spammers instead of fighting spam don't need RMX or
> any of the other superficial quick fixes.

  Ah.  So systems which may give another few-month lifespan to
existing mail systems until we have better methods, are to be opposed
simply because they're not long-term solutions.

  Alan DeKok.

---

From: Dave Crocker <[email-masked]>
Date: Mon, 5 May 2003 14:27:31 -0700

Alan,

AD>   My apologies.  I had thought that ASRG was about discussing the
AD> requirements and design of any solution.  Since that's wrong...

"solution" is supposed to have something to do with effectiveness.

an explanation of the real utility of rmx records has, so far, been
based on assumptions and assertions that run contrary to the user and
operations history of the Internet.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Michael Rubel <[email-masked]>
Date: Mon, 5 May 2003 15:39:39 -0700 (PDT)

Dear all,

This certainly has been a lively discussion.

I learned a few things, and added some notes to the page at:

	http://www.mikerubel.org/computers/rmx_records/

But at this point, I continue to stand by RMX records.  The objections
raised thus far haven't convinced me--basically that because RMX records
won't single-handedly end spam overnight, they aren't useful.

This argument seems to stem from a misunderstanding of the intent.

RMX gives senders a mechanism to prevent others from credibly
misappropriating their names, and it does so at minimal implementation
cost--especially to recipients (I hope that "use_rmx" will become a single
configuration flag in MTAs, on by default).  It doesn't introduce any new
protocols or break the vast majority of existing installations (I suppose
there will always be some, but even the most vehement critic must concede 
that RMX is remarkably non-disruptive given its potential utility).

In some cases, organizations wishing to implement RMX will need to make
changes to accommodate their traveling or remote members, so that those
members are able to send mail via the official mail servers.  A wide
variety of common techniques (SMTP-AUTH, VPN, stunnel, webmail) are
already available and widely used specifically for this purpose, and
organizations will be free to make the changes on their own schedules and
terms.

Domains employing RMX will have shown an intent to be good netizens, and
their mail will be held to a higher spam-probability threshold than
non-RMX domains.  Forged email claiming to come from an RMX-protected
domain will be held to a very low spam-probability threshold--perhaps even
zero (automatic discard).  In this way, RMX will give useful information 
to help filters distinguish spam from ham, and will become more useful as 
it becomes more prevalent.

I sincerely appreciate everyone's input.

Mike

---

From: Daniel Feenberg <[email-masked]>
Date: Mon, 5 May 2003 21:01:31 -0400 (EDT)

> with unforged headers that point directly at themselves.

I think what is left unstated in this dispute is that the RMX proponents
would like to discriminate among senders at a finer level than the IP
address of the connecting host. They want to accept legitimate mail from
spam-friendly connection IPs, and reject other mail. This would reduce the
need for ISPs to "censor" their customer's incoming/outgoing mail, and the
need for customers to find an ISP with a mail policy they can live with.

One way to imagine this happening, is if the receiving sites kept records
by sender of the spam status of messages. If a.example.com had sent
legitimate mail in the past, and b.example.com had sent spam, then
marginally spammy looking mail from a.example.com could be accepted, even
though the connecting machine was "dirty" from b.example.com. Hopefully
this would allow a lower type-2 error rate. This is unreliable now,
because MAIL FROM addresses are unreliable.

However, if the RMX proposal were successfull, then sending sites could
stop suppressing spam, knowing that receiving sites won't hold it against
them, provided the MAIL FROM: addresses in spam messages don't overlap
with legitimate mail. I do not regard that as a desirable state of
affairs. While the receiving site has reduced its type-2 error rate, it
has removed the only significant incentive sending sites have to
supervise their mail, meaning even more spam for everyone else.

---

From: Yakov Shafranovich <[email-masked]>
Date: Mon, 05 May 2003 21:49:18 -0400

We certainly had a good discussion on using RMX. However, there is one 
issue that has been bugging me that was not mentioned. With the current 
SMTP system it is very easy to send anonymous email. However, what will 
happen if RMX is used? RMX is designed to authenticate the domain of the 
sender, not the actual user so it is still possible to use a proxy to send 
the email for you. A mixmaster anonymous remailer or a web mail account 
that was created through www.anonymizer.com can still be used to send email 
as long as their domains have RMX records.

However, ask yourselves this question: how long will it take until spammers 
will start using anonymous mixmaster remailers? Even though one individual 
remailer might be capable to detecting incoming spam, if multiple remailers 
are used that would be impossible. If spammers now are capable of using 
multiple IP addresses and gateways, then they can certainly use multiple 
remailers. If that happens, how long will it take the rest of the Internet 
community to blacklist the remailers? At the present time it is much easier 
for spammers to utilize open relays and SMTP gateways rather then mixmaster 
remailers so they are not used. However, if that avenue is closed they will 
be forced to use any tools available including remailers. It is rather 
surprising that they have not been used widely so far. In the future, if 
the RMX system is deployed how long will it take until those domains are 
blacklisted?

With this in mind, consider if we want to "kill" anonymous email. Even the 
postal system still allows mail to be sent anonymously as long as the 
postage is paid. Even though people might argue that it is worth to lose 
privacy versus having spam, I am not so sure. We need to draw a balance here.

Nevertheless, even with anonymous remailers gone, there are still many 
other options open like webmail accounts, HushMail, etc. But just like the 
people desiring privacy will turn to those, so will the spammers. Without 
some inherent antispam tools in webmail accounts, those domains will become 
blacklisted eventually as well. We must keep in mind privacy concerns when 
developing any anti-spam system.

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------

---

From: David Walker <[email-masked]>
Date: Tue, 6 May 2003 08:43:27 -0500

I want to see an RMX type scheme implemented because it is necessary to 
reduce/end the freely forgeable mail protocol we have now.  With an RMX type 
scheme forging is greatly reduced.

This would reduce the ISP's need to censor incoming/outgoing mail.  I am not 
in favor of any scheme that involves other people or their programs reading 
my mail.

The goal of the RMX type scheme is to make the spammer accountable instead of 
the ISP.  The spammer is the one responsible for abusing the system and is 
the best target for our wrath.

With regard to accepting legitimate mail from spam friendly connection IPs, an 
RMX system lets you set up a program to notify you of the abuse.  One day 
your mail server starts getting hit with 100 invalid (according to RMX) 
emails and you look at it and fix it.  Or the opposite side, you accidently 
set up an open relay and suddenly get notified of 1000 RMX failures in 
outgoing mail (You then fix it right away and feel silly for making such a 
mistake).  It is a win-win situation.

---

From: David Walker <[email-masked]>
Date: Tue, 6 May 2003 10:20:57 -0500

The reason RMX records haven't made a big impact to date is the lack of a 
standard.  On this list there have been numerous proposals, each slightly 
different and each one has been met with silly arguments like "if we do that 
I won't be able to send anonymous e-mails pretending to be Ronald Reagan" or, 
more realistically, "but then I'd have to send my hotmail messages actually 
through the hotmail service and that would suck"

---

From: Dave Crocker <[email-masked]>
Date: Tue, 6 May 2003 08:54:19 -0700

David,

When you are summarizing comments from others, please make some effort
to reflect what they actually said.  Re-casting their statements into a
form that is silly and false is not especially constructive.

d/

DW> The reason RMX records haven't made a big impact to date is the lack of a
DW> standard.  On this list there have been numerous proposals, each slightly
DW> different and each one has been met with silly arguments like "if we do that
DW> I won't be able to send anonymous e-mails pretending to be Ronald Reagan" or,
DW> more realistically, "but then I'd have to send my hotmail messages actually
DW> through the hotmail service and that would suck"

---

From: "Alan DeKok" <[email-masked]>
Date: Tue, 06 May 2003 12:34:28 -0400

> as long as their domains have RMX records.

  It is the responsibility of the administrator of the remailer to
minimize the amount of spam flowing through his system, or others will
block mail from his domain.  RMX changes nothing.

  Alan DeKok.

---

From: Vernon Schryver <[email-masked]>
Date: Tue, 6 May 2003 10:55:45 -0600 (MDT)

> From: David Walker <[email-masked]>

> standard. ...

The idea that writing and publishing a standard as an RFC causes
a protocol or other idea to be used is quite popular.  Many people have
the illusion that soon after an RFC is written, the Internet starts
using it.  That idea is quite wrong.  Publishing a standard has very
little effect on whether a protocol or procecure is ever used.

The purpose of the IETF is to encourage interoperable implementations.
The IETF tends to reduce competition between competing standards, but
it is almost useless for getting a standard used.

However, feel free to see if I'm wrong.  You can get an RFC defining
whatever you like as an RMX protocol published within a month.  You
don't need from permission me, Paul Judge, or anyone else but the RFC
Editor, and they are quite liberal.  If I'm wrong, in less time than
this mailing list has existed, RMX would be fixing lots of spam.

---

From: David Walker <[email-masked]>
Date: Tue, 6 May 2003 12:07:20 -0500

No disrespect was intended.  The silly quotes were not meant to refer to 
anything you said but to be a general, while sarcastic, summary of the list's 
response to RMX and similar schemes.

On Tuesday 06 May 2003 10:54 am, Dave Crocker wrote:
> DW> The reason RMX records haven't made a big impact to date is the lack of
> a DW> standard.  On this list there have been numerous proposals, each
> slightly DW> different and each one has been met with silly arguments like
> "if we do that DW> I won't be able to send anonymous e-mails pretending to
> be Ronald Reagan" or, DW> more realistically, "but then I'd have to send my
> hotmail messages actually DW> through the hotmail service and that would
> suck"
>

---

From: "Tom Thomson" <[email-masked]>
Date: Wed, 7 May 2003 20:07:38 +0100

>through the hotmail service and that would suck"

What you say is "more realistic" actually isn't, it's a misleading piece of
rubbish foisted on you by people who either don't understand that what
matters to these guys (hotmail clients) is content header not envelope
header while what matters to thr rMX proposals is the envelope header - or
perhaps by people who fully understand that but don't care about accuracy as
long as they can attack the rMX proposal.

I don't like rMX either, but I've got so fed up with the braindead attacks
on it by certain contributors to this list that I'm just about prepared to
defend it to the death!

Tom